* linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-15 19:49 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-15 19:49 UTC (permalink / raw) To: LKML; +Cc: linux-mm, legion, containers, Eric W . Biederman Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u Logs below: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 26546 at kernel/ucount.c:253 dec_ucount+0x43/0x50 Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_magn_3d hid_sensor_rotation hid_sensor_accel_3d hid_sensor_gyro_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader nft_counter intel_ishtp_hid snd_hda_codec_hdmi intel_rapl_msr xt_mark ipt_REJECT nf_reject_ipv4 snd_ctl_led xt_LOG snd_hda_codec_conexant nf_log_syslog snd_hda_codec_generic xt_addrtype xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv4 mei_hdcp snd_hda_intel nft_compat wmi_bmof nf_tables intel_rapl_common libcrc32c think_lmi intel_tcc_cooling snd_intel_dspcfg firmware_attributes_class nfnetlink iwlmvm intel_wmi_thunderbolt mac80211 x86_pkg_temp_thermal snd_hda_codec intel_powerclamp coretemp libarc4 vfat fat kvm_intel rapl intel_cstate snd_hwdep intel_uncore iwlwifi snd_hda_core mousedev joydev snd_pcm psmouse cfg80211 snd_timer mei_me ucsi_acpi wacom intel_ish_ipc intel_xhci_usb_role_switch mei intel_pch_thermal typec_ucsi roles typec intel_ishtp wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore rfkill tpm_crb i2c_hid_acpi i2c_hid acpi_pad tpm_tis mac_hid tpm_tis_core pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd xhci_pci rtsx_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm kvm irqbypass CPU: 1 PID: 26546 Comm: kworker/1:1 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x43/0x50 Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000628f892be9f8 CR3: 000000002880e004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 ---[ end trace eb7a8d38b64b2d3a ]--- BUG: kernel NULL pointer dereference, address: 00000000000001e8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: 0000 [#1] SMP PTI CPU: 1 PID: 26546 Comm: kworker/1:1 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 000000002880e004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 ^ permalink raw reply [flat|nested] 70+ messages in thread
* linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-15 19:49 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-15 19:49 UTC (permalink / raw) To: LKML; +Cc: linux-mm, legion, containers, Eric W . Biederman Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u Logs below: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 26546 at kernel/ucount.c:253 dec_ucount+0x43/0x50 Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_magn_3d hid_sensor_rotation hid_sensor_accel_3d hid_sensor_gyro_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader nft_counter intel_ishtp_hid snd_hda_codec_hdmi intel_rapl_msr xt_mark ipt_REJECT nf_reject_ipv4 snd_ctl_led xt_LOG snd_hda_codec_conexant nf_log_syslog snd_hda_codec_generic xt_addrtype xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv4 mei_hdcp snd_hda_intel nft_compat wmi_bmof nf_tables intel_rapl_common libcrc32c think_lmi intel_tcc_cooling snd_intel_dspcfg firmware_attributes_class nfnetlink iwlmvm intel_wmi_thunderbolt mac80211 x86_pkg_temp_thermal snd_hda_codec intel_powerclamp coretemp libarc4 vfat fat kvm_intel rapl intel_cstate snd_hwdep intel_uncore iwlwifi snd_hda_core mousedev joydev snd_pcm psmouse cfg80211 snd_timer mei_me ucsi_acpi wacom intel_ish_ipc intel_xhci_usb_role_switch mei intel_pch_thermal typec_ucsi roles typec intel_ishtp wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore rfkill tpm_crb i2c_hid_acpi i2c_hid acpi_pad tpm_tis mac_hid tpm_tis_core pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd xhci_pci rtsx_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm kvm irqbypass CPU: 1 PID: 26546 Comm: kworker/1:1 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x43/0x50 Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000628f892be9f8 CR3: 000000002880e004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 ---[ end trace eb7a8d38b64b2d3a ]--- BUG: kernel NULL pointer dereference, address: 00000000000001e8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: 0000 [#1] SMP PTI CPU: 1 PID: 26546 Comm: kworker/1:1 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 000000002880e004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-15 19:49 ` Jordan Glover @ 2021-09-15 21:02 ` Eric W. Biederman -1 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-09-15 21:02 UTC (permalink / raw) To: Jordan Glover; +Cc: LKML, linux-mm, legion, containers Jordan Glover <Golden_Miller83@protonmail.ch> writes: > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u So that warning comes from: void dec_ucount(struct ucounts *ucounts, enum ucount_type type) { struct ucounts *iter; for (iter = ucounts; iter; iter = iter->ns->ucounts) { long dec = atomic_long_dec_if_positive(&iter->ucount[type]); WARN_ON_ONCE(dec < 0); } put_ucounts(ucounts); } Which certainly looks like a reference count bug. It could also be a memory stomp somewhere close. Do you have any idea what else was going on? This location is the symptom but not the actual cause. Eric > > Logs below: > > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 26546 at kernel/ucount.c:253 dec_ucount+0x43/0x50 > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_magn_3d hid_sensor_rotation hid_sensor_accel_3d hid_sensor_gyro_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader nft_counter intel_ishtp_hid snd_hda_codec_hdmi intel_rapl_msr xt_mark ipt_REJECT nf_reject_ipv4 snd_ctl_led xt_LOG snd_hda_codec_conexant nf_log_syslog snd_hda_codec_generic xt_addrtype xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv4 mei_hdcp snd_hda_intel nft_compat wmi_bmof nf_tables intel_rapl_common libcrc32c think_lmi intel_tcc_cooling snd_intel_dspcfg firmware_attributes_class nfnetlink iwlmvm > intel_wmi_thunderbolt mac80211 x86_pkg_temp_thermal snd_hda_codec intel_powerclamp coretemp libarc4 vfat fat kvm_intel rapl intel_cstate snd_hwdep intel_uncore iwlwifi snd_hda_core mousedev joydev snd_pcm psmouse cfg80211 snd_timer mei_me ucsi_acpi wacom intel_ish_ipc intel_xhci_usb_role_switch mei intel_pch_thermal typec_ucsi roles typec intel_ishtp wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore rfkill tpm_crb i2c_hid_acpi i2c_hid acpi_pad tpm_tis mac_hid tpm_tis_core pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd xhci_pci rtsx_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec > drm kvm irqbypass > CPU: 1 PID: 26546 Comm: kworker/1:1 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x43/0x50 > Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 > RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 > RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 > RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 > R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000628f892be9f8 CR3: 000000002880e004 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 > ---[ end trace eb7a8d38b64b2d3a ]--- > BUG: kernel NULL pointer dereference, address: 00000000000001e8 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > Oops: 0000 [#1] SMP PTI > CPU: 1 PID: 26546 Comm: kworker/1:1 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x32/0x50 > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 > RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 > RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 > R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001e8 CR3: 000000002880e004 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-15 21:02 ` Eric W. Biederman 0 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-09-15 21:02 UTC (permalink / raw) To: Jordan Glover; +Cc: LKML, linux-mm, legion, containers Jordan Glover <Golden_Miller83@protonmail.ch> writes: > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u So that warning comes from: void dec_ucount(struct ucounts *ucounts, enum ucount_type type) { struct ucounts *iter; for (iter = ucounts; iter; iter = iter->ns->ucounts) { long dec = atomic_long_dec_if_positive(&iter->ucount[type]); WARN_ON_ONCE(dec < 0); } put_ucounts(ucounts); } Which certainly looks like a reference count bug. It could also be a memory stomp somewhere close. Do you have any idea what else was going on? This location is the symptom but not the actual cause. Eric > > Logs below: > > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 26546 at kernel/ucount.c:253 dec_ucount+0x43/0x50 > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_magn_3d hid_sensor_rotation hid_sensor_accel_3d hid_sensor_gyro_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader nft_counter intel_ishtp_hid snd_hda_codec_hdmi intel_rapl_msr xt_mark ipt_REJECT nf_reject_ipv4 snd_ctl_led xt_LOG snd_hda_codec_conexant nf_log_syslog snd_hda_codec_generic xt_addrtype xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv4 mei_hdcp snd_hda_intel nft_compat wmi_bmof nf_tables intel_rapl_common libcrc32c think_lmi intel_tcc_cooling snd_intel_dspcfg firmware_attributes_class nfnetlink iwlmv m > intel_wmi_thunderbolt mac80211 x86_pkg_temp_thermal snd_hda_codec intel_powerclamp coretemp libarc4 vfat fat kvm_intel rapl intel_cstate snd_hwdep intel_uncore iwlwifi snd_hda_core mousedev joydev snd_pcm psmouse cfg80211 snd_timer mei_me ucsi_acpi wacom intel_ish_ipc intel_xhci_usb_role_switch mei intel_pch_thermal typec_ucsi roles typec intel_ishtp wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore rfkill tpm_crb i2c_hid_acpi i2c_hid acpi_pad tpm_tis mac_hid tpm_tis_core pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd xhci_pci rtsx_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec > drm kvm irqbypass > CPU: 1 PID: 26546 Comm: kworker/1:1 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x43/0x50 > Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 > RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 > RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 > RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 > R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000628f892be9f8 CR3: 000000002880e004 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 > ---[ end trace eb7a8d38b64b2d3a ]--- > BUG: kernel NULL pointer dereference, address: 00000000000001e8 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > Oops: 0000 [#1] SMP PTI > CPU: 1 PID: 26546 Comm: kworker/1:1 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x32/0x50 > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > RSP: 0018:ffffa82cc2bd7e60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffffa2f53298ee50 RCX: ffffa2f3c0061000 > RDX: ffffa2f3c0061020 RSI: ffffffffffffffff RDI: ffffa2f3c0061000 > RBP: ffffa2f53298ebe0 R08: 0000000000000020 R09: 0000000000000000 > R10: 0000000000000001 R11: 0000000000000000 R12: ffffa2f3c0061000 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffffa2f599680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001e8 CR3: 000000002880e004 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-15 21:02 ` Eric W. Biederman @ 2021-09-15 22:42 ` Jordan Glover -1 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-15 22:42 UTC (permalink / raw) To: ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > > > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u > > So that warning comes from: > > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) > > { > > struct ucounts *iter; > > for (iter = ucounts; iter; iter = iter->ns->ucounts) { > > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); > > WARN_ON_ONCE(dec < 0); > } > put_ucounts(ucounts); > > > } > > Which certainly looks like a reference count bug. It could also be a > > memory stomp somewhere close. > > Do you have any idea what else was going on? This location is the > > symptom but not the actual cause. > > Eric I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. Maybe it's some random fluke. I'll reply if I hit it again. Jordan ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-15 22:42 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-15 22:42 UTC (permalink / raw) To: ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > > > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u > > So that warning comes from: > > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) > > { > > struct ucounts *iter; > > for (iter = ucounts; iter; iter = iter->ns->ucounts) { > > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); > > WARN_ON_ONCE(dec < 0); > } > put_ucounts(ucounts); > > > } > > Which certainly looks like a reference count bug. It could also be a > > memory stomp somewhere close. > > Do you have any idea what else was going on? This location is the > > symptom but not the actual cause. > > Eric I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. Maybe it's some random fluke. I'll reply if I hit it again. Jordan ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-15 22:42 ` Jordan Glover @ 2021-09-15 23:44 ` Yu Zhao -1 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-09-15 23:44 UTC (permalink / raw) To: Jordan Glover, ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org On Wed, Sep 15, 2021 at 4:42 PM Jordan Glover <Golden_Miller83@protonmail.ch> wrote: > > On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > > > > > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u > > > > So that warning comes from: > > > > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) > > > > { > > > > struct ucounts *iter; > > > > for (iter = ucounts; iter; iter = iter->ns->ucounts) { > > > > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); > > > > WARN_ON_ONCE(dec < 0); > > } > > put_ucounts(ucounts); > > > > > > } > > > > Which certainly looks like a reference count bug. It could also be a > > > > memory stomp somewhere close. > > > > Do you have any idea what else was going on? This location is the > > > > symptom but not the actual cause. > > > > Eric > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > Maybe it's some random fluke. I'll reply if I hit it again. I have been able to steadily reproduce this for a while. But I haven't had time to look into it. I'd appreciate any help. [ 1324.741762] ================================================================== [ 1324.749200] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 1324.755198] Write of size 8 at addr ffffff808f2f0120 by task kworker/7:2/1817 [ 1324.762523] [ 1324.764063] CPU: 7 PID: 1817 Comm: kworker/7:2 Not tainted 5.14.0-lockdep+ #7 [ 1324.771396] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 1324.778098] Workqueue: events free_user_ns [ 1324.782320] Call trace: [ 1324.784845] dump_backtrace+0x0/0x42c [ 1324.788614] show_stack+0x24/0x30 [ 1324.792026] dump_stack_lvl+0xd0/0x100 [ 1324.795884] print_address_description+0x30/0x304 [ 1324.800725] kasan_report+0x190/0x1d8 [ 1324.804494] kasan_check_range+0x1ac/0x1bc [ 1324.808708] __kasan_check_write+0x44/0x54 [ 1324.812923] dec_ucount+0x50/0xd8 [ 1324.816334] free_user_ns+0x1b0/0x288 [ 1324.820102] process_one_work+0x7b4/0x10ec [ 1324.824318] worker_thread+0x800/0xcf4 [ 1324.828176] kthread+0x2a8/0x358 [ 1324.831500] ret_from_fork+0x10/0x18 [ 1324.835182] [ 1324.836720] Allocated by task 5167: [ 1324.840312] kasan_save_stack+0x38/0x68 [ 1324.844261] __kasan_slab_alloc+0x6c/0x88 [ 1324.848387] kmem_cache_alloc+0x234/0x47c [ 1324.852505] getname_flags+0xb4/0x3b8 [ 1324.856273] __arm64_sys_unlink+0x4c/0x68 [ 1324.860400] invoke_syscall+0xd4/0x2c8 [ 1324.864258] el0_svc_common+0x124/0x200 [ 1324.868199] do_el0_svc_compat+0x54/0x64 [ 1324.872235] el0_svc_compat+0x24/0x34 [ 1324.876003] el0t_32_sync_handler+0xc0/0xf0 [ 1324.880307] el0t_32_sync+0x19c/0x1a0 [ 1324.884078] [ 1324.885616] Freed by task 5167: [ 1324.888848] kasan_save_stack+0x38/0x68 [ 1324.892797] kasan_set_track+0x28/0x3c [ 1324.896653] kasan_set_free_info+0x28/0x4c [ 1324.900865] ____kasan_slab_free+0x118/0x164 [ 1324.905259] __kasan_slab_free+0x18/0x28 [ 1324.909296] kmem_cache_free+0x1c0/0x4b8 [ 1324.913325] putname+0xd0/0x140 [ 1324.916554] do_unlinkat+0x518/0x57c [ 1324.920233] __arm64_sys_unlink+0x58/0x68 [ 1324.924359] invoke_syscall+0xd4/0x2c8 [ 1324.928215] el0_svc_common+0x124/0x200 [ 1324.932164] do_el0_svc_compat+0x54/0x64 [ 1324.936195] el0_svc_compat+0x24/0x34 [ 1324.939963] el0t_32_sync_handler+0xc0/0xf0 [ 1324.944259] el0t_32_sync+0x19c/0x1a0 [ 1324.948029] [ 1324.949567] The buggy address belongs to the object at ffffff808f2f0040 [ 1324.949567] which belongs to the cache names_cache of size 4096 [ 1324.962498] The buggy address is located 224 bytes inside of [ 1324.962498] 4096-byte region [ffffff808f2f0040, ffffff808f2f1040) [ 1324.974635] The buggy address belongs to the page: [ 1324.979561] page:fffffffe023cbc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffff808f2f23c0 pfn:0x10f2f0 [ 1324.990536] head:fffffffe023cbc00 order:3 compound_mapcount:0 compound_pincount:0 [ 1324.998220] flags: 0x8000000000010200(slab|head|zone=2) [ 1325.003596] raw: 8000000000010200 fffffffe02b59a08 fffffffe0247a208 ffffff808036ad80 [ 1325.011549] raw: ffffff808f2f23c0 0000000000070006 00000001ffffffff 0000000000000000 [ 1325.019494] page dumped because: kasan: bad access detected [ 1325.025214] [ 1325.026751] Memory state around the buggy address: [ 1325.031680] ffffff808f2f0000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 1325.039093] ffffff808f2f0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.046506] >ffffff808f2f0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.053920] ^ [ 1325.058311] ffffff808f2f0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.065725] ffffff808f2f0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.073153] ================================================================== [ 7358.532846] ================================================================== [ 7358.540369] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 7358.546429] Write of size 8 at addr ffffff800af71120 by task kworker/3:1/27623 [ 7358.553880] [ 7358.555458] CPU: 3 PID: 27623 Comm: kworker/3:1 Not tainted 5.14.0-lockdep+ #13 [ 7358.563013] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 7358.569761] Workqueue: events free_user_ns [ 7358.574039] Call trace: [ 7358.576595] dump_backtrace+0x0/0x42c [ 7358.580402] show_stack+0x24/0x30 [ 7358.583842] dump_stack_lvl+0xd0/0x100 [ 7358.587732] print_address_description+0x30/0x304 [ 7358.592608] kasan_report+0x190/0x1d8 [ 7358.596405] kasan_check_range+0x1ac/0x1bc [ 7358.600643] __kasan_check_write+0x44/0x54 [ 7358.604876] dec_ucount+0x50/0xd8 [ 7358.608317] free_user_ns+0x1b0/0x288 [ 7358.612106] process_one_work+0x7b4/0x10ec [ 7358.616354] worker_thread+0x800/0xcf4 [ 7358.620234] kthread+0x2a8/0x358 [ 7358.623585] ret_from_fork+0x10/0x18 [ 7358.627297] [ 7358.628861] Allocated by task 26538: [ 7358.632556] kasan_save_stack+0x38/0x68 [ 7358.636537] __kasan_kmalloc+0x9c/0xb8 [ 7358.640424] kmem_cache_alloc_trace+0x2a4/0x370 [ 7358.645104] fscrypt_setup_filename+0x3bc/0x754 [ 7358.649793] ext4_find_entry+0x80/0x240 [ 7358.653774] __ext4_unlink+0x88/0x594 [ 7358.657563] ext4_unlink+0x458/0x99c [ 7358.661263] vfs_unlink+0x22c/0x340 [ 7358.664877] do_unlinkat+0x358/0x57c [ 7358.668586] __arm64_sys_unlinkat+0xa8/0xc4 [ 7358.672920] invoke_syscall+0xd4/0x2c8 [ 7358.676808] el0_svc_common+0x124/0x200 [ 7358.680781] do_el0_svc_compat+0x54/0x64 [ 7358.684835] el0_svc_compat+0x24/0x34 [ 7358.688640] el0t_32_sync_handler+0xc0/0xf0 [ 7358.692973] el0t_32_sync+0x19c/0x1a0 [ 7358.696772] [ 7358.698331] Freed by task 26538: [ 7358.701668] kasan_save_stack+0x38/0x68 [ 7358.705646] kasan_set_track+0x28/0x3c [ 7358.709533] kasan_set_free_info+0x28/0x4c [ 7358.713772] ____kasan_slab_free+0x118/0x164 [ 7358.718186] __kasan_slab_free+0x18/0x28 [ 7358.722240] kfree+0x2f8/0x500 [ 7358.725403] ext4_find_entry+0x19c/0x240 [ 7358.729469] __ext4_unlink+0x88/0x594 [ 7358.733265] ext4_unlink+0x458/0x99c [ 7358.736968] vfs_unlink+0x22c/0x340 [ 7358.740587] do_unlinkat+0x358/0x57c [ 7358.744285] __arm64_sys_unlinkat+0xa8/0xc4 [ 7358.748610] invoke_syscall+0xd4/0x2c8 [ 7358.752495] el0_svc_common+0x124/0x200 [ 7358.756464] do_el0_svc_compat+0x54/0x64 [ 7358.760522] el0_svc_compat+0x24/0x34 [ 7358.764320] el0t_32_sync_handler+0xc0/0xf0 [ 7358.768653] el0t_32_sync+0x19c/0x1a0 [ 7358.772453] [ 7358.774015] Last potentially related work creation: [ 7358.779053] kasan_save_stack+0x38/0x68 [ 7358.783025] kasan_record_aux_stack+0xdc/0x108 [ 7358.787619] call_rcu+0x180/0xed4 [ 7358.791061] __ip6_del_rt+0xfc/0x130 [ 7358.794771] ip6_route_del+0xa74/0xb74 [ 7358.798653] inet6_rtm_delroute+0x31c/0x3e4 [ 7358.802986] rtnetlink_rcv_msg+0x3d0/0x928 [ 7358.807242] netlink_rcv_skb+0x164/0x2ac [ 7358.811311] rtnetlink_rcv+0x24/0x30 [ 7358.815025] netlink_unicast+0x328/0x518 [ 7358.819083] netlink_sendmsg+0x5c0/0x934 [ 7358.823142] sock_sendmsg+0xb8/0xdc [ 7358.826764] __sys_sendto+0x218/0x3e4 [ 7358.830557] __arm64_sys_send+0xac/0xc8 [ 7358.834526] invoke_syscall+0xd4/0x2c8 [ 7358.838413] el0_svc_common+0x124/0x200 [ 7358.842382] do_el0_svc_compat+0x54/0x64 [ 7358.846443] el0_svc_compat+0x24/0x34 [ 7358.850245] el0t_32_sync_handler+0xc0/0xf0 [ 7358.854578] el0t_32_sync+0x19c/0x1a0 [ 7358.858382] [ 7358.859941] Second to last potentially related work creation: [ 7358.865862] kasan_save_stack+0x38/0x68 [ 7358.869850] kasan_record_aux_stack+0xdc/0x108 [ 7358.874452] insert_work+0x60/0x22c [ 7358.878072] __queue_work+0xae8/0xe74 [ 7358.881866] queue_work_on+0x100/0x148 [ 7358.885752] drm_atomic_helper_commit+0x18c/0x1f4 [ 7358.890615] drm_atomic_nonblocking_commit+0xc4/0xdc [ 7358.895749] drm_mode_atomic_ioctl+0x89c/0xaa0 [ 7358.900353] drm_ioctl_kernel+0x15c/0x260 [ 7358.904505] drm_ioctl+0x460/0x828 [ 7358.908029] drm_compat_ioctl+0x1bc/0x230 [ 7358.912176] __arm64_compat_sys_ioctl+0x1b0/0x1c4 [ 7358.917037] invoke_syscall+0xd4/0x2c8 [ 7358.920919] el0_svc_common+0x124/0x200 [ 7358.924887] do_el0_svc_compat+0x54/0x64 [ 7358.928946] el0_svc_compat+0x24/0x34 [ 7358.932735] el0t_32_sync_handler+0xc0/0xf0 [ 7358.937065] el0t_32_sync+0x19c/0x1a0 [ 7358.940853] [ 7358.942408] The buggy address belongs to the object at ffffff800af71100 [ 7358.942408] which belongs to the cache kmalloc-256 of size 256 [ 7358.955282] The buggy address is located 32 bytes inside of [ 7358.955282] 256-byte region [ffffff800af71100, ffffff800af71200) [ 7358.967268] The buggy address belongs to the page: [ 7358.972209] page:fffffffe002bdc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8af70 [ 7358.981790] head:fffffffe002bdc00 order:3 compound_mapcount:0 compound_pincount:0 [ 7358.989493] flags: 0x10200(slab|head|zone=0) [ 7358.993922] raw: 0000000000010200 fffffffe021e0c08 fffffffe02960008 ffffff808000c980 [ 7359.001898] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [ 7359.009867] page dumped because: kasan: bad access detected [ 7359.015607] [ 7359.017162] Memory state around the buggy address: [ 7359.022105] ffffff800af71000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7359.029543] ffffff800af71080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7359.036981] >ffffff800af71100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7359.044414] ^ [ 7359.048818] ffffff800af71180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7359.056256] ffffff800af71200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7359.063695] ================================================================== ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-15 23:44 ` Yu Zhao 0 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-09-15 23:44 UTC (permalink / raw) To: Jordan Glover, ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org On Wed, Sep 15, 2021 at 4:42 PM Jordan Glover <Golden_Miller83@protonmail.ch> wrote: > > On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > > > > > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u > > > > So that warning comes from: > > > > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) > > > > { > > > > struct ucounts *iter; > > > > for (iter = ucounts; iter; iter = iter->ns->ucounts) { > > > > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); > > > > WARN_ON_ONCE(dec < 0); > > } > > put_ucounts(ucounts); > > > > > > } > > > > Which certainly looks like a reference count bug. It could also be a > > > > memory stomp somewhere close. > > > > Do you have any idea what else was going on? This location is the > > > > symptom but not the actual cause. > > > > Eric > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > Maybe it's some random fluke. I'll reply if I hit it again. I have been able to steadily reproduce this for a while. But I haven't had time to look into it. I'd appreciate any help. [ 1324.741762] ================================================================== [ 1324.749200] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 1324.755198] Write of size 8 at addr ffffff808f2f0120 by task kworker/7:2/1817 [ 1324.762523] [ 1324.764063] CPU: 7 PID: 1817 Comm: kworker/7:2 Not tainted 5.14.0-lockdep+ #7 [ 1324.771396] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 1324.778098] Workqueue: events free_user_ns [ 1324.782320] Call trace: [ 1324.784845] dump_backtrace+0x0/0x42c [ 1324.788614] show_stack+0x24/0x30 [ 1324.792026] dump_stack_lvl+0xd0/0x100 [ 1324.795884] print_address_description+0x30/0x304 [ 1324.800725] kasan_report+0x190/0x1d8 [ 1324.804494] kasan_check_range+0x1ac/0x1bc [ 1324.808708] __kasan_check_write+0x44/0x54 [ 1324.812923] dec_ucount+0x50/0xd8 [ 1324.816334] free_user_ns+0x1b0/0x288 [ 1324.820102] process_one_work+0x7b4/0x10ec [ 1324.824318] worker_thread+0x800/0xcf4 [ 1324.828176] kthread+0x2a8/0x358 [ 1324.831500] ret_from_fork+0x10/0x18 [ 1324.835182] [ 1324.836720] Allocated by task 5167: [ 1324.840312] kasan_save_stack+0x38/0x68 [ 1324.844261] __kasan_slab_alloc+0x6c/0x88 [ 1324.848387] kmem_cache_alloc+0x234/0x47c [ 1324.852505] getname_flags+0xb4/0x3b8 [ 1324.856273] __arm64_sys_unlink+0x4c/0x68 [ 1324.860400] invoke_syscall+0xd4/0x2c8 [ 1324.864258] el0_svc_common+0x124/0x200 [ 1324.868199] do_el0_svc_compat+0x54/0x64 [ 1324.872235] el0_svc_compat+0x24/0x34 [ 1324.876003] el0t_32_sync_handler+0xc0/0xf0 [ 1324.880307] el0t_32_sync+0x19c/0x1a0 [ 1324.884078] [ 1324.885616] Freed by task 5167: [ 1324.888848] kasan_save_stack+0x38/0x68 [ 1324.892797] kasan_set_track+0x28/0x3c [ 1324.896653] kasan_set_free_info+0x28/0x4c [ 1324.900865] ____kasan_slab_free+0x118/0x164 [ 1324.905259] __kasan_slab_free+0x18/0x28 [ 1324.909296] kmem_cache_free+0x1c0/0x4b8 [ 1324.913325] putname+0xd0/0x140 [ 1324.916554] do_unlinkat+0x518/0x57c [ 1324.920233] __arm64_sys_unlink+0x58/0x68 [ 1324.924359] invoke_syscall+0xd4/0x2c8 [ 1324.928215] el0_svc_common+0x124/0x200 [ 1324.932164] do_el0_svc_compat+0x54/0x64 [ 1324.936195] el0_svc_compat+0x24/0x34 [ 1324.939963] el0t_32_sync_handler+0xc0/0xf0 [ 1324.944259] el0t_32_sync+0x19c/0x1a0 [ 1324.948029] [ 1324.949567] The buggy address belongs to the object at ffffff808f2f0040 [ 1324.949567] which belongs to the cache names_cache of size 4096 [ 1324.962498] The buggy address is located 224 bytes inside of [ 1324.962498] 4096-byte region [ffffff808f2f0040, ffffff808f2f1040) [ 1324.974635] The buggy address belongs to the page: [ 1324.979561] page:fffffffe023cbc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffff808f2f23c0 pfn:0x10f2f0 [ 1324.990536] head:fffffffe023cbc00 order:3 compound_mapcount:0 compound_pincount:0 [ 1324.998220] flags: 0x8000000000010200(slab|head|zone=2) [ 1325.003596] raw: 8000000000010200 fffffffe02b59a08 fffffffe0247a208 ffffff808036ad80 [ 1325.011549] raw: ffffff808f2f23c0 0000000000070006 00000001ffffffff 0000000000000000 [ 1325.019494] page dumped because: kasan: bad access detected [ 1325.025214] [ 1325.026751] Memory state around the buggy address: [ 1325.031680] ffffff808f2f0000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 1325.039093] ffffff808f2f0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.046506] >ffffff808f2f0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.053920] ^ [ 1325.058311] ffffff808f2f0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.065725] ffffff808f2f0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1325.073153] ================================================================== [ 7358.532846] ================================================================== [ 7358.540369] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 7358.546429] Write of size 8 at addr ffffff800af71120 by task kworker/3:1/27623 [ 7358.553880] [ 7358.555458] CPU: 3 PID: 27623 Comm: kworker/3:1 Not tainted 5.14.0-lockdep+ #13 [ 7358.563013] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 7358.569761] Workqueue: events free_user_ns [ 7358.574039] Call trace: [ 7358.576595] dump_backtrace+0x0/0x42c [ 7358.580402] show_stack+0x24/0x30 [ 7358.583842] dump_stack_lvl+0xd0/0x100 [ 7358.587732] print_address_description+0x30/0x304 [ 7358.592608] kasan_report+0x190/0x1d8 [ 7358.596405] kasan_check_range+0x1ac/0x1bc [ 7358.600643] __kasan_check_write+0x44/0x54 [ 7358.604876] dec_ucount+0x50/0xd8 [ 7358.608317] free_user_ns+0x1b0/0x288 [ 7358.612106] process_one_work+0x7b4/0x10ec [ 7358.616354] worker_thread+0x800/0xcf4 [ 7358.620234] kthread+0x2a8/0x358 [ 7358.623585] ret_from_fork+0x10/0x18 [ 7358.627297] [ 7358.628861] Allocated by task 26538: [ 7358.632556] kasan_save_stack+0x38/0x68 [ 7358.636537] __kasan_kmalloc+0x9c/0xb8 [ 7358.640424] kmem_cache_alloc_trace+0x2a4/0x370 [ 7358.645104] fscrypt_setup_filename+0x3bc/0x754 [ 7358.649793] ext4_find_entry+0x80/0x240 [ 7358.653774] __ext4_unlink+0x88/0x594 [ 7358.657563] ext4_unlink+0x458/0x99c [ 7358.661263] vfs_unlink+0x22c/0x340 [ 7358.664877] do_unlinkat+0x358/0x57c [ 7358.668586] __arm64_sys_unlinkat+0xa8/0xc4 [ 7358.672920] invoke_syscall+0xd4/0x2c8 [ 7358.676808] el0_svc_common+0x124/0x200 [ 7358.680781] do_el0_svc_compat+0x54/0x64 [ 7358.684835] el0_svc_compat+0x24/0x34 [ 7358.688640] el0t_32_sync_handler+0xc0/0xf0 [ 7358.692973] el0t_32_sync+0x19c/0x1a0 [ 7358.696772] [ 7358.698331] Freed by task 26538: [ 7358.701668] kasan_save_stack+0x38/0x68 [ 7358.705646] kasan_set_track+0x28/0x3c [ 7358.709533] kasan_set_free_info+0x28/0x4c [ 7358.713772] ____kasan_slab_free+0x118/0x164 [ 7358.718186] __kasan_slab_free+0x18/0x28 [ 7358.722240] kfree+0x2f8/0x500 [ 7358.725403] ext4_find_entry+0x19c/0x240 [ 7358.729469] __ext4_unlink+0x88/0x594 [ 7358.733265] ext4_unlink+0x458/0x99c [ 7358.736968] vfs_unlink+0x22c/0x340 [ 7358.740587] do_unlinkat+0x358/0x57c [ 7358.744285] __arm64_sys_unlinkat+0xa8/0xc4 [ 7358.748610] invoke_syscall+0xd4/0x2c8 [ 7358.752495] el0_svc_common+0x124/0x200 [ 7358.756464] do_el0_svc_compat+0x54/0x64 [ 7358.760522] el0_svc_compat+0x24/0x34 [ 7358.764320] el0t_32_sync_handler+0xc0/0xf0 [ 7358.768653] el0t_32_sync+0x19c/0x1a0 [ 7358.772453] [ 7358.774015] Last potentially related work creation: [ 7358.779053] kasan_save_stack+0x38/0x68 [ 7358.783025] kasan_record_aux_stack+0xdc/0x108 [ 7358.787619] call_rcu+0x180/0xed4 [ 7358.791061] __ip6_del_rt+0xfc/0x130 [ 7358.794771] ip6_route_del+0xa74/0xb74 [ 7358.798653] inet6_rtm_delroute+0x31c/0x3e4 [ 7358.802986] rtnetlink_rcv_msg+0x3d0/0x928 [ 7358.807242] netlink_rcv_skb+0x164/0x2ac [ 7358.811311] rtnetlink_rcv+0x24/0x30 [ 7358.815025] netlink_unicast+0x328/0x518 [ 7358.819083] netlink_sendmsg+0x5c0/0x934 [ 7358.823142] sock_sendmsg+0xb8/0xdc [ 7358.826764] __sys_sendto+0x218/0x3e4 [ 7358.830557] __arm64_sys_send+0xac/0xc8 [ 7358.834526] invoke_syscall+0xd4/0x2c8 [ 7358.838413] el0_svc_common+0x124/0x200 [ 7358.842382] do_el0_svc_compat+0x54/0x64 [ 7358.846443] el0_svc_compat+0x24/0x34 [ 7358.850245] el0t_32_sync_handler+0xc0/0xf0 [ 7358.854578] el0t_32_sync+0x19c/0x1a0 [ 7358.858382] [ 7358.859941] Second to last potentially related work creation: [ 7358.865862] kasan_save_stack+0x38/0x68 [ 7358.869850] kasan_record_aux_stack+0xdc/0x108 [ 7358.874452] insert_work+0x60/0x22c [ 7358.878072] __queue_work+0xae8/0xe74 [ 7358.881866] queue_work_on+0x100/0x148 [ 7358.885752] drm_atomic_helper_commit+0x18c/0x1f4 [ 7358.890615] drm_atomic_nonblocking_commit+0xc4/0xdc [ 7358.895749] drm_mode_atomic_ioctl+0x89c/0xaa0 [ 7358.900353] drm_ioctl_kernel+0x15c/0x260 [ 7358.904505] drm_ioctl+0x460/0x828 [ 7358.908029] drm_compat_ioctl+0x1bc/0x230 [ 7358.912176] __arm64_compat_sys_ioctl+0x1b0/0x1c4 [ 7358.917037] invoke_syscall+0xd4/0x2c8 [ 7358.920919] el0_svc_common+0x124/0x200 [ 7358.924887] do_el0_svc_compat+0x54/0x64 [ 7358.928946] el0_svc_compat+0x24/0x34 [ 7358.932735] el0t_32_sync_handler+0xc0/0xf0 [ 7358.937065] el0t_32_sync+0x19c/0x1a0 [ 7358.940853] [ 7358.942408] The buggy address belongs to the object at ffffff800af71100 [ 7358.942408] which belongs to the cache kmalloc-256 of size 256 [ 7358.955282] The buggy address is located 32 bytes inside of [ 7358.955282] 256-byte region [ffffff800af71100, ffffff800af71200) [ 7358.967268] The buggy address belongs to the page: [ 7358.972209] page:fffffffe002bdc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8af70 [ 7358.981790] head:fffffffe002bdc00 order:3 compound_mapcount:0 compound_pincount:0 [ 7358.989493] flags: 0x10200(slab|head|zone=0) [ 7358.993922] raw: 0000000000010200 fffffffe021e0c08 fffffffe02960008 ffffff808000c980 [ 7359.001898] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [ 7359.009867] page dumped because: kasan: bad access detected [ 7359.015607] [ 7359.017162] Memory state around the buggy address: [ 7359.022105] ffffff800af71000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7359.029543] ffffff800af71080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7359.036981] >ffffff800af71100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7359.044414] ^ [ 7359.048818] ffffff800af71180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7359.056256] ffffff800af71200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7359.063695] ================================================================== ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-15 23:44 ` Yu Zhao @ 2021-09-17 16:15 ` Eric W. Biederman -1 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-09-17 16:15 UTC (permalink / raw) To: Yu Zhao; +Cc: Jordan Glover, LKML, linux-mm, legion, containers Yu Zhao <yuzhao@google.com> writes: > On Wed, Sep 15, 2021 at 4:42 PM Jordan Glover > <Golden_Miller83@protonmail.ch> wrote: >> >> On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: >> >> > Jordan Glover Golden_Miller83@protonmail.ch writes: >> > >> > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window >> > > >> > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u >> > >> > So that warning comes from: >> > >> > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) >> > >> > { >> > >> > struct ucounts *iter; >> > >> > for (iter = ucounts; iter; iter = iter->ns->ucounts) { >> > >> > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); >> > >> > WARN_ON_ONCE(dec < 0); >> > } >> > put_ucounts(ucounts); >> > >> > >> > } >> > >> > Which certainly looks like a reference count bug. It could also be a >> > >> > memory stomp somewhere close. >> > >> > Do you have any idea what else was going on? This location is the >> > >> > symptom but not the actual cause. >> > >> > Eric >> >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. >> >> Maybe it's some random fluke. I'll reply if I hit it again. > > I have been able to steadily reproduce this for a while. But I haven't > had time to look into it. I'd appreciate any help. It would be very helpful if you could look farther back in your logs and see if you can also see: WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x5 Or anything else preceding the use-after-free. I am inclined to think they are the same issue but without seeing the WARN_ON_ONCE I can't safely conclude that. Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-17 16:15 ` Eric W. Biederman 0 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-09-17 16:15 UTC (permalink / raw) To: Yu Zhao; +Cc: Jordan Glover, LKML, linux-mm, legion, containers Yu Zhao <yuzhao@google.com> writes: > On Wed, Sep 15, 2021 at 4:42 PM Jordan Glover > <Golden_Miller83@protonmail.ch> wrote: >> >> On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: >> >> > Jordan Glover Golden_Miller83@protonmail.ch writes: >> > >> > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window >> > > >> > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u >> > >> > So that warning comes from: >> > >> > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) >> > >> > { >> > >> > struct ucounts *iter; >> > >> > for (iter = ucounts; iter; iter = iter->ns->ucounts) { >> > >> > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); >> > >> > WARN_ON_ONCE(dec < 0); >> > } >> > put_ucounts(ucounts); >> > >> > >> > } >> > >> > Which certainly looks like a reference count bug. It could also be a >> > >> > memory stomp somewhere close. >> > >> > Do you have any idea what else was going on? This location is the >> > >> > symptom but not the actual cause. >> > >> > Eric >> >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. >> >> Maybe it's some random fluke. I'll reply if I hit it again. > > I have been able to steadily reproduce this for a while. But I haven't > had time to look into it. I'd appreciate any help. It would be very helpful if you could look farther back in your logs and see if you can also see: WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x5 Or anything else preceding the use-after-free. I am inclined to think they are the same issue but without seeing the WARN_ON_ONCE I can't safely conclude that. Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-17 16:15 ` Eric W. Biederman @ 2021-09-17 18:45 ` Yu Zhao -1 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-09-17 18:45 UTC (permalink / raw) To: Eric W. Biederman; +Cc: Jordan Glover, LKML, linux-mm, legion, containers On Fri, Sep 17, 2021 at 10:17 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > Yu Zhao <yuzhao@google.com> writes: > > > On Wed, Sep 15, 2021 at 4:42 PM Jordan Glover > > <Golden_Miller83@protonmail.ch> wrote: > >> > >> On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: > >> > >> > Jordan Glover Golden_Miller83@protonmail.ch writes: > >> > > >> > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > >> > > > >> > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u > >> > > >> > So that warning comes from: > >> > > >> > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) > >> > > >> > { > >> > > >> > struct ucounts *iter; > >> > > >> > for (iter = ucounts; iter; iter = iter->ns->ucounts) { > >> > > >> > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); > >> > > >> > WARN_ON_ONCE(dec < 0); > >> > } > >> > put_ucounts(ucounts); > >> > > >> > > >> > } > >> > > >> > Which certainly looks like a reference count bug. It could also be a > >> > > >> > memory stomp somewhere close. > >> > > >> > Do you have any idea what else was going on? This location is the > >> > > >> > symptom but not the actual cause. > >> > > >> > Eric > >> > >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > >> > >> Maybe it's some random fluke. I'll reply if I hit it again. > > > > I have been able to steadily reproduce this for a while. But I haven't > > had time to look into it. I'd appreciate any help. > > It would be very helpful if you could look farther back in your logs and > see if you can also see: > WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x5 > > Or anything else preceding the use-after-free. > > I am inclined to think they are the same issue but without seeing the > WARN_ON_ONCE I can't safely conclude that. It was either the WARN_ON_ONCE or the KASAN before my kernel crashed. (KASAN is on for both cases.) [ 3049.540734] ------------[ cut here ]------------^M [ 3049.545557] WARNING: CPU: 0 PID: 8369 at kernel/ucount.c:253 dec_ucount+0xb0/0xd8^M [ 3049.553293] Modules linked in: vhost_vsock vhost vhost_iotlb vmw_vsock_virtio_transport_common vsock rfcomm algif_hash algif_skcipher af_alg uinput uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig videobuf2_memops cros_ec_typec typec hci_uart btqca bluetooth ecdh_generic ecc venus_core v4l2_mem2mem videobuf2_v4l2 videobuf2_common qcom_q6v5_mss ipa qcom_pil_info qcom_q6v5 qcom_common xt_MASQUERADE rmtfs_mem fuse ath10k_snoc qmi_helpers ath10k_core ath mac80211 lzo_rle lzo_compress cfg80211 zram smsc smsc95xx usbnet mii joydev^M [ 3049.603135] CPU: 0 PID: 8369 Comm: kworker/0:2 Not tainted 5.14.0-lockdep+ #4^M [ 3049.610506] Hardware name: Google Lazor (rev3+) with KB Backlight (DT)^M [ 3049.617230] Workqueue: events free_user_ns^M [ 3049.621494] pstate: a0400009 (NzCv daif +PAN -UAO -TCO BTYPE=--)^M [ 3049.627694] pc : dec_ucount+0xb0/0xd8^M [ 3049.631489] lr : dec_ucount+0x50/0xd8^M [ 3049.635280] sp : ffffffc019ff7b50^M [ 3049.638707] x29: ffffffc019ff7b50 x28: ffffffd5b5d8b710 x27: ffffff80884cae90^M [ 3049.646083] x26: dfffffc000000000 x25: ffffffd5b5de98a0 x24: 0000000000000001^M [ 3049.653460] x23: ffffff80d2597100 x22: 0000000000000000 x21: dfffffc000000000^M [ 3049.660838] x20: ffffff80d2597120 x19: ffffff80d2597100 x18: 1ffffff01b4b3f48^M [ 3049.668210] x17: 1ffffff01b4b3f47 x16: 0000000000000000 x15: 0000000000000000^M [ 3049.675585] x14: 0000000000000000 x13: 000000002b0cc34b x12: 0000000024966d0f^M [ 3049.682960] x11: 0000000000000000 x10: dfffffc000000001 x9 : 0000000000000000^M [ 3049.690334] x8 : ffffff80d259791f x7 : 0000000000000000 x6 : ffffffd5b3de71c4^M [ 3049.697709] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffffffd5b3391ca4^M [ 3049.705086] x2 : 0000000000000001 x1 : 0000000000000008 x0 : 0000000000000001^M [ 3049.712459] Call trace:^M [ 3049.715003] dec_ucount+0xb0/0xd8^M [ 3049.718443] free_user_ns+0x1b0/0x288^M [ 3049.722242] process_one_work+0x7b4/0x10ec^M [ 3049.726485] worker_thread+0x800/0xcf4^M [ 3049.730377] kthread+0x2a8/0x358^M [ 3049.733736] ret_from_fork+0x10/0x18^M [ 3049.737445] irq event stamp: 0^M [ 3049.740612] hardirqs last enabled at (0): [<0000000000000000>] 0x0^M [ 3049.747092] hardirqs last disabled at (0): [<ffffffd5b331413c>] copy_process+0xcb0/0x2a54^M [ 3049.755521] softirqs last enabled at (0): [<ffffffd5b3314164>] copy_process+0xcd8/0x2a54^M [ 3049.763954] softirqs last disabled at (0): [<0000000000000000>] 0x0^M [ 3049.770432] ---[ end trace fa55518c981c0c5d ]---^M ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-17 18:45 ` Yu Zhao 0 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-09-17 18:45 UTC (permalink / raw) To: Eric W. Biederman; +Cc: Jordan Glover, LKML, linux-mm, legion, containers On Fri, Sep 17, 2021 at 10:17 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > Yu Zhao <yuzhao@google.com> writes: > > > On Wed, Sep 15, 2021 at 4:42 PM Jordan Glover > > <Golden_Miller83@protonmail.ch> wrote: > >> > >> On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@xmission.com> wrote: > >> > >> > Jordan Glover Golden_Miller83@protonmail.ch writes: > >> > > >> > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window > >> > > > >> > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u > >> > > >> > So that warning comes from: > >> > > >> > void dec_ucount(struct ucounts *ucounts, enum ucount_type type) > >> > > >> > { > >> > > >> > struct ucounts *iter; > >> > > >> > for (iter = ucounts; iter; iter = iter->ns->ucounts) { > >> > > >> > long dec = atomic_long_dec_if_positive(&iter->ucount[type]); > >> > > >> > WARN_ON_ONCE(dec < 0); > >> > } > >> > put_ucounts(ucounts); > >> > > >> > > >> > } > >> > > >> > Which certainly looks like a reference count bug. It could also be a > >> > > >> > memory stomp somewhere close. > >> > > >> > Do you have any idea what else was going on? This location is the > >> > > >> > symptom but not the actual cause. > >> > > >> > Eric > >> > >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > >> > >> Maybe it's some random fluke. I'll reply if I hit it again. > > > > I have been able to steadily reproduce this for a while. But I haven't > > had time to look into it. I'd appreciate any help. > > It would be very helpful if you could look farther back in your logs and > see if you can also see: > WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x5 > > Or anything else preceding the use-after-free. > > I am inclined to think they are the same issue but without seeing the > WARN_ON_ONCE I can't safely conclude that. It was either the WARN_ON_ONCE or the KASAN before my kernel crashed. (KASAN is on for both cases.) [ 3049.540734] ------------[ cut here ]------------^M [ 3049.545557] WARNING: CPU: 0 PID: 8369 at kernel/ucount.c:253 dec_ucount+0xb0/0xd8^M [ 3049.553293] Modules linked in: vhost_vsock vhost vhost_iotlb vmw_vsock_virtio_transport_common vsock rfcomm algif_hash algif_skcipher af_alg uinput uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig videobuf2_memops cros_ec_typec typec hci_uart btqca bluetooth ecdh_generic ecc venus_core v4l2_mem2mem videobuf2_v4l2 videobuf2_common qcom_q6v5_mss ipa qcom_pil_info qcom_q6v5 qcom_common xt_MASQUERADE rmtfs_mem fuse ath10k_snoc qmi_helpers ath10k_core ath mac80211 lzo_rle lzo_compress cfg80211 zram smsc smsc95xx usbnet mii joydev^M [ 3049.603135] CPU: 0 PID: 8369 Comm: kworker/0:2 Not tainted 5.14.0-lockdep+ #4^M [ 3049.610506] Hardware name: Google Lazor (rev3+) with KB Backlight (DT)^M [ 3049.617230] Workqueue: events free_user_ns^M [ 3049.621494] pstate: a0400009 (NzCv daif +PAN -UAO -TCO BTYPE=--)^M [ 3049.627694] pc : dec_ucount+0xb0/0xd8^M [ 3049.631489] lr : dec_ucount+0x50/0xd8^M [ 3049.635280] sp : ffffffc019ff7b50^M [ 3049.638707] x29: ffffffc019ff7b50 x28: ffffffd5b5d8b710 x27: ffffff80884cae90^M [ 3049.646083] x26: dfffffc000000000 x25: ffffffd5b5de98a0 x24: 0000000000000001^M [ 3049.653460] x23: ffffff80d2597100 x22: 0000000000000000 x21: dfffffc000000000^M [ 3049.660838] x20: ffffff80d2597120 x19: ffffff80d2597100 x18: 1ffffff01b4b3f48^M [ 3049.668210] x17: 1ffffff01b4b3f47 x16: 0000000000000000 x15: 0000000000000000^M [ 3049.675585] x14: 0000000000000000 x13: 000000002b0cc34b x12: 0000000024966d0f^M [ 3049.682960] x11: 0000000000000000 x10: dfffffc000000001 x9 : 0000000000000000^M [ 3049.690334] x8 : ffffff80d259791f x7 : 0000000000000000 x6 : ffffffd5b3de71c4^M [ 3049.697709] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffffffd5b3391ca4^M [ 3049.705086] x2 : 0000000000000001 x1 : 0000000000000008 x0 : 0000000000000001^M [ 3049.712459] Call trace:^M [ 3049.715003] dec_ucount+0xb0/0xd8^M [ 3049.718443] free_user_ns+0x1b0/0x288^M [ 3049.722242] process_one_work+0x7b4/0x10ec^M [ 3049.726485] worker_thread+0x800/0xcf4^M [ 3049.730377] kthread+0x2a8/0x358^M [ 3049.733736] ret_from_fork+0x10/0x18^M [ 3049.737445] irq event stamp: 0^M [ 3049.740612] hardirqs last enabled at (0): [<0000000000000000>] 0x0^M [ 3049.747092] hardirqs last disabled at (0): [<ffffffd5b331413c>] copy_process+0xcb0/0x2a54^M [ 3049.755521] softirqs last enabled at (0): [<ffffffd5b3314164>] copy_process+0xcd8/0x2a54^M [ 3049.763954] softirqs last disabled at (0): [<0000000000000000>] 0x0^M [ 3049.770432] ---[ end trace fa55518c981c0c5d ]---^M ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-15 22:42 ` Jordan Glover @ 2021-09-15 23:47 ` Jordan Glover -1 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-15 23:47 UTC (permalink / raw) To: ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover <Golden_Miller83@protonmail.ch> wrote: > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > Maybe it's some random fluke. I'll reply if I hit it again. Heh, it jut happened again. This time closing firefox alone had such effect: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x50 Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm kvm irqbypass CPU: 1 PID: 351 Comm: kworker/1:3 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x43/0x50 Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056ffceff6b10 CR3: 0000000147a0e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 ---[ end trace ff45ac39689f43c1 ]--- BUG: kernel NULL pointer dereference, address: 00000000000001e8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: 0000 [#1] SMP PTI CPU: 1 PID: 351 Comm: kworker/1:3 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm kvm irqbypass CR2: 00000000000001e8 ---[ end trace ff45ac39689f43c2 ]--- RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-15 23:47 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-15 23:47 UTC (permalink / raw) To: ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover <Golden_Miller83@protonmail.ch> wrote: > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > Maybe it's some random fluke. I'll reply if I hit it again. Heh, it jut happened again. This time closing firefox alone had such effect: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x50 Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm kvm irqbypass CPU: 1 PID: 351 Comm: kworker/1:3 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x43/0x50 Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056ffceff6b10 CR3: 0000000147a0e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 ---[ end trace ff45ac39689f43c1 ]--- BUG: kernel NULL pointer dereference, address: 00000000000001e8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: 0000 [#1] SMP PTI CPU: 1 PID: 351 Comm: kworker/1:3 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f Workqueue: events free_user_ns RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_user_ns+0x73/0x110 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm kvm irqbypass CR2: 00000000000001e8 ---[ end trace ff45ac39689f43c2 ]--- RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-15 23:47 ` Jordan Glover @ 2021-09-16 17:30 ` Eric W. Biederman -1 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-09-16 17:30 UTC (permalink / raw) To: Jordan Glover; +Cc: LKML, linux-mm, legion, containers, Yu Zhao Jordan Glover <Golden_Miller83@protonmail.ch> writes: > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover <Golden_Miller83@protonmail.ch> wrote: >> >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. >> >> Maybe it's some random fluke. I'll reply if I hit it again. > > Heh, it jut happened again. This time closing firefox alone had such > effect: Ok. It looks like he have a couple of folks seeing issues here. I thought we had all of the issues sorted out for the release of v5.14, but it looks like there is still some little bug left. If Alex doesn't beat me to it I will see if I can come up with a debugging patch to make it easy to help track down where the reference count is going wrong. It will be a little bit as my brain is mush at the moment. Eric > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x50 > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > fb_sys_fops cec drm kvm irqbypass > CPU: 1 PID: 351 Comm: kworker/1:3 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x43/0x50 > Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000056ffceff6b10 CR3: 0000000147a0e005 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 > ---[ end trace ff45ac39689f43c1 ]--- > BUG: kernel NULL pointer dereference, address: 00000000000001e8 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > Oops: 0000 [#1] SMP PTI > CPU: 1 PID: 351 Comm: kworker/1:3 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x32/0x50 > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > fb_sys_fops cec drm kvm irqbypass > CR2: 00000000000001e8 > ---[ end trace ff45ac39689f43c2 ]--- > RIP: 0010:dec_ucount+0x32/0x50 > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-16 17:30 ` Eric W. Biederman 0 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-09-16 17:30 UTC (permalink / raw) To: Jordan Glover; +Cc: LKML, linux-mm, legion, containers, Yu Zhao Jordan Glover <Golden_Miller83@protonmail.ch> writes: > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover <Golden_Miller83@protonmail.ch> wrote: >> >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. >> >> Maybe it's some random fluke. I'll reply if I hit it again. > > Heh, it jut happened again. This time closing firefox alone had such > effect: Ok. It looks like he have a couple of folks seeing issues here. I thought we had all of the issues sorted out for the release of v5.14, but it looks like there is still some little bug left. If Alex doesn't beat me to it I will see if I can come up with a debugging patch to make it easy to help track down where the reference count is going wrong. It will be a little bit as my brain is mush at the moment. Eric > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x50 > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > fb_sys_fops cec drm kvm irqbypass > CPU: 1 PID: 351 Comm: kworker/1:3 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x43/0x50 > Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000056ffceff6b10 CR3: 0000000147a0e005 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 > ---[ end trace ff45ac39689f43c1 ]--- > BUG: kernel NULL pointer dereference, address: 00000000000001e8 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > Oops: 0000 [#1] SMP PTI > CPU: 1 PID: 351 Comm: kworker/1:3 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > Workqueue: events free_user_ns > RIP: 0010:dec_ucount+0x32/0x50 > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > free_user_ns+0x73/0x110 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > fb_sys_fops cec drm kvm irqbypass > CR2: 00000000000001e8 > ---[ end trace ff45ac39689f43c2 ]--- > RIP: 0010:dec_ucount+0x32/0x50 > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-16 17:30 ` Eric W. Biederman @ 2021-09-16 19:14 ` Alexey Gladkov -1 siblings, 0 replies; 70+ messages in thread From: Alexey Gladkov @ 2021-09-16 19:14 UTC (permalink / raw) To: Eric W. Biederman; +Cc: Jordan Glover, LKML, linux-mm, containers, Yu Zhao On Thu, Sep 16, 2021 at 12:30:44PM -0500, Eric W. Biederman wrote: > Jordan Glover <Golden_Miller83@protonmail.ch> writes: > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover <Golden_Miller83@protonmail.ch> wrote: > >> > >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > >> > >> Maybe it's some random fluke. I'll reply if I hit it again. > > > > Heh, it jut happened again. This time closing firefox alone had such > > effect: > > Ok. It looks like he have a couple of folks seeing issues here. > > I thought we had all of the issues sorted out for the release of v5.14, > but it looks like there is still some little bug left. > > If Alex doesn't beat me to it I will see if I can come up with a > debugging patch to make it easy to help track down where the reference > count is going wrong. It will be a little bit as my brain is mush at > the moment. I'm poking it right now, but so far without much success. The dec_ucount() happened free_user_ns(). There we only decrease the UCOUNT_USER_NAMESPACES in the user_ns tree. Perhaps somewhere someone forgot to do create_user_ns() ? > Eric > > > ------------[ cut here ]------------ > > WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x50 > > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > > fb_sys_fops cec drm kvm irqbypass > > CPU: 1 PID: 351 Comm: kworker/1:3 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > > Workqueue: events free_user_ns > > RIP: 0010:dec_ucount+0x43/0x50 > > Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 > > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 000056ffceff6b10 CR3: 0000000147a0e005 CR4: 00000000003706e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > Call Trace: > > free_user_ns+0x73/0x110 > > process_one_work+0x1e1/0x380 > > worker_thread+0x50/0x3a0 > > ? rescuer_thread+0x360/0x360 > > kthread+0x127/0x150 > > ? set_kthread_struct+0x40/0x40 > > ret_from_fork+0x22/0x30 > > ---[ end trace ff45ac39689f43c1 ]--- > > BUG: kernel NULL pointer dereference, address: 00000000000001e8 > > #PF: supervisor read access in kernel mode > > #PF: error_code(0x0000) - not-present page > > Oops: 0000 [#1] SMP PTI > > CPU: 1 PID: 351 Comm: kworker/1:3 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > > Workqueue: events free_user_ns > > RIP: 0010:dec_ucount+0x32/0x50 > > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > Call Trace: > > free_user_ns+0x73/0x110 > > process_one_work+0x1e1/0x380 > > worker_thread+0x50/0x3a0 > > ? rescuer_thread+0x360/0x360 > > kthread+0x127/0x150 > > ? set_kthread_struct+0x40/0x40 > > ret_from_fork+0x22/0x30 > > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > > fb_sys_fops cec drm kvm irqbypass > > CR2: 00000000000001e8 > > ---[ end trace ff45ac39689f43c2 ]--- > > RIP: 0010:dec_ucount+0x32/0x50 > > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > -- Rgrds, legion ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-16 19:14 ` Alexey Gladkov 0 siblings, 0 replies; 70+ messages in thread From: Alexey Gladkov @ 2021-09-16 19:14 UTC (permalink / raw) To: Eric W. Biederman; +Cc: Jordan Glover, LKML, linux-mm, containers, Yu Zhao On Thu, Sep 16, 2021 at 12:30:44PM -0500, Eric W. Biederman wrote: > Jordan Glover <Golden_Miller83@protonmail.ch> writes: > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover <Golden_Miller83@protonmail.ch> wrote: > >> > >> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > >> > >> Maybe it's some random fluke. I'll reply if I hit it again. > > > > Heh, it jut happened again. This time closing firefox alone had such > > effect: > > Ok. It looks like he have a couple of folks seeing issues here. > > I thought we had all of the issues sorted out for the release of v5.14, > but it looks like there is still some little bug left. > > If Alex doesn't beat me to it I will see if I can come up with a > debugging patch to make it easy to help track down where the reference > count is going wrong. It will be a little bit as my brain is mush at > the moment. I'm poking it right now, but so far without much success. The dec_ucount() happened free_user_ns(). There we only decrease the UCOUNT_USER_NAMESPACES in the user_ns tree. Perhaps somewhere someone forgot to do create_user_ns() ? > Eric > > > ------------[ cut here ]------------ > > WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x50 > > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > > fb_sys_fops cec drm kvm irqbypass > > CPU: 1 PID: 351 Comm: kworker/1:3 Not tainted 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > > Workqueue: events free_user_ns > > RIP: 0010:dec_ucount+0x43/0x50 > > Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 > > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 000056ffceff6b10 CR3: 0000000147a0e005 CR4: 00000000003706e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > Call Trace: > > free_user_ns+0x73/0x110 > > process_one_work+0x1e1/0x380 > > worker_thread+0x50/0x3a0 > > ? rescuer_thread+0x360/0x360 > > kthread+0x127/0x150 > > ? set_kthread_struct+0x40/0x40 > > ret_from_fork+0x22/0x30 > > ---[ end trace ff45ac39689f43c1 ]--- > > BUG: kernel NULL pointer dereference, address: 00000000000001e8 > > #PF: supervisor read access in kernel mode > > #PF: error_code(0x0000) - not-present page > > Oops: 0000 [#1] SMP PTI > > CPU: 1 PID: 351 Comm: kworker/1:3 Tainted: G W 5.14.3 #1 c719caf0c6c208968387ed83e3061ac05d0faf2f > > Workqueue: events free_user_ns > > RIP: 0010:dec_ucount+0x32/0x50 > > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > Call Trace: > > free_user_ns+0x73/0x110 > > process_one_work+0x1e1/0x380 > > worker_thread+0x50/0x3a0 > > ? rescuer_thread+0x360/0x360 > > kthread+0x127/0x150 > > ? set_kthread_struct+0x40/0x40 > > ret_from_fork+0x22/0x30 > > Modules linked in: nft_ct nft_fib_ipv4 nft_fib wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 poly1305_x86_64 udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic libchacha ccm algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash af_alg hid_sensor_custom_intel_hinge hid_sensor_als hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_rotation hid_sensor_magn_3d hid_sensor_trigger industrialio_triggered_buffer hid_sensor_iio_common kfifo_buf industrialio hid_sensor_custom hid_sensor_hub cros_ec_ishtp cros_ec intel_ishtp_loader intel_ishtp_hid intel_rapl_msr nft_counter xt_mark ipt_REJECT nf_reject_ipv4 mei_hdcp intel_rapl_common xt_LOG nf_log_syslog intel_tcc_cooling x86_pkg_temp_thermal think_lmi wmi_bmof xt_addrtype firmware_attributes_class xt_tcpudp intel_powerclamp xt_conntrack nf_conntrack nf_defrag_ipv4 snd_hda_codec_hdmi nft_compat intel_wmi_thunderbolt nf_tables libcrc32c coretemp iwlmvm snd_ctl_led nfnetlink > > snd_hda_codec_conexant mac80211 snd_hda_codec_generic libarc4 vfat snd_hda_intel kvm_intel fat iwlwifi snd_intel_dspcfg rapl intel_cstate joydev snd_hda_codec mousedev intel_uncore snd_hwdep snd_hda_core psmouse snd_pcm snd_timer cfg80211 mei_me wacom ucsi_acpi typec_ucsi mei intel_pch_thermal intel_xhci_usb_role_switch intel_ish_ipc roles intel_ishtp typec wmi thinkpad_acpi ledtrig_audio platform_profile snd soundcore tpm_crb rfkill i2c_hid_acpi tpm_tis tpm_tis_core i2c_hid mac_hid acpi_pad pkcs8_key_parser fuse zram ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core dm_mod rtsx_pci_sdmmc mmc_core serio_raw atkbd libps2 crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd rtsx_pci xhci_pci xhci_pci_renesas i8042 serio kvmgt mdev vfio_iommu_type1 vfio i915 i2c_algo_bit intel_gtt ttm agpgart video drm_kms_helper syscopyarea sysfillrect sysimgblt > > fb_sys_fops cec drm kvm irqbypass > > CR2: 00000000000001e8 > > ---[ end trace ff45ac39689f43c2 ]--- > > RIP: 0010:dec_ucount+0x32/0x50 > > Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 0d fd ff ff 0f 0b eb e7 66 > > RSP: 0018:ffffaa06c08bbe60 EFLAGS: 00010297 > > RAX: 0000000000000000 RBX: ffff894ecb0c35a0 RCX: ffff894e25cdfcc0 > > RDX: ffff894e25cdfce0 RSI: ffffffffffffffff RDI: ffff894e25cdfcc0 > > RBP: ffff894ee393d380 R08: 0000000000000020 R09: ffff894ee393d5f0 > > R10: ffff894f617fd000 R11: 0000000000031678 R12: ffff894e25cdfcc0 > > R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001 > > FS: 0000000000000000(0000) GS:ffff894f59680000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 00000000000001e8 CR3: 0000000147a0e005 CR4: 00000000003706e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > -- Rgrds, legion ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-16 17:30 ` Eric W. Biederman @ 2021-09-28 13:40 ` Jordan Glover -1 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-28 13:40 UTC (permalink / raw) To: ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org, Yu Zhao On Thursday, September 16th, 2021 at 5:30 PM, <ebiederm@xmission.com> wrote: > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > Heh, it jut happened again. This time closing firefox alone had such > > effect: > > Ok. It looks like he have a couple of folks seeing issues here. > I thought we had all of the issues sorted out for the release of v5.14, > but it looks like there is still some little bug left. > > If Alex doesn't beat me to it I will see if I can come up with a > debugging patch to make it easy to help track down where the reference > count is going wrong. It will be a little bit as my brain is mush at > the moment. > > Eric As the issue persist in 5.14.7 I would be very interested in such patch. For now the thing is mostly reproducible when I close several tabs in ff then close the browser in short period of time. When I close tabs then wait out a bit then close the browser it doesn't happen so I guess some interrupted cleanup triggers it. Jordan ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-28 13:40 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-28 13:40 UTC (permalink / raw) To: ebiederm Cc: LKML, linux-mm\@kvack.org, legion\@kernel.org, containers\@lists.linux-foundation.org, Yu Zhao On Thursday, September 16th, 2021 at 5:30 PM, <ebiederm@xmission.com> wrote: > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > Heh, it jut happened again. This time closing firefox alone had such > > effect: > > Ok. It looks like he have a couple of folks seeing issues here. > I thought we had all of the issues sorted out for the release of v5.14, > but it looks like there is still some little bug left. > > If Alex doesn't beat me to it I will see if I can come up with a > debugging patch to make it easy to help track down where the reference > count is going wrong. It will be a little bit as my brain is mush at > the moment. > > Eric As the issue persist in 5.14.7 I would be very interested in such patch. For now the thing is mostly reproducible when I close several tabs in ff then close the browser in short period of time. When I close tabs then wait out a bit then close the browser it doesn't happen so I guess some interrupted cleanup triggers it. Jordan ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-28 13:40 ` Jordan Glover @ 2021-09-29 17:36 ` Alexey Gladkov -1 siblings, 0 replies; 70+ messages in thread From: Alexey Gladkov @ 2021-09-29 17:36 UTC (permalink / raw) To: Jordan Glover Cc: ebiederm, LKML, linux-mm\@kvack.org, containers\@lists.linux-foundation.org, Yu Zhao On Tue, Sep 28, 2021 at 01:40:48PM +0000, Jordan Glover wrote: > On Thursday, September 16th, 2021 at 5:30 PM, <ebiederm@xmission.com> wrote: > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > > > Heh, it jut happened again. This time closing firefox alone had such > > > effect: > > > > Ok. It looks like he have a couple of folks seeing issues here. > > I thought we had all of the issues sorted out for the release of v5.14, > > but it looks like there is still some little bug left. > > > > If Alex doesn't beat me to it I will see if I can come up with a > > debugging patch to make it easy to help track down where the reference > > count is going wrong. It will be a little bit as my brain is mush at > > the moment. > > > > Eric > > As the issue persist in 5.14.7 I would be very interested in such patch. > > For now the thing is mostly reproducible when I close several tabs in ff then > close the browser in short period of time. When I close tabs then wait out > a bit then close the browser it doesn't happen so I guess some interrupted > cleanup triggers it. I'm still investigating, but I would like to rule out one option. Could you check out the patch? diff --git a/kernel/ucount.c b/kernel/ucount.c index bb51849e6375..f23f906f4f62 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -201,11 +201,14 @@ void put_ucounts(struct ucounts *ucounts) { unsigned long flags; - if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { + spin_lock_irqsave(&ucounts_lock, flags); + if (atomic_dec_and_test(&ucounts->count)) { hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); kfree(ucounts); + return; } + spin_unlock_irqrestore(&ucounts_lock, flags); } static inline bool atomic_long_inc_below(atomic_long_t *v, int u) -- Rgrds, legion ^ permalink raw reply related [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-29 17:36 ` Alexey Gladkov 0 siblings, 0 replies; 70+ messages in thread From: Alexey Gladkov @ 2021-09-29 17:36 UTC (permalink / raw) To: Jordan Glover Cc: ebiederm, LKML, linux-mm\@kvack.org, containers\@lists.linux-foundation.org, Yu Zhao On Tue, Sep 28, 2021 at 01:40:48PM +0000, Jordan Glover wrote: > On Thursday, September 16th, 2021 at 5:30 PM, <ebiederm@xmission.com> wrote: > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > > > Heh, it jut happened again. This time closing firefox alone had such > > > effect: > > > > Ok. It looks like he have a couple of folks seeing issues here. > > I thought we had all of the issues sorted out for the release of v5.14, > > but it looks like there is still some little bug left. > > > > If Alex doesn't beat me to it I will see if I can come up with a > > debugging patch to make it easy to help track down where the reference > > count is going wrong. It will be a little bit as my brain is mush at > > the moment. > > > > Eric > > As the issue persist in 5.14.7 I would be very interested in such patch. > > For now the thing is mostly reproducible when I close several tabs in ff then > close the browser in short period of time. When I close tabs then wait out > a bit then close the browser it doesn't happen so I guess some interrupted > cleanup triggers it. I'm still investigating, but I would like to rule out one option. Could you check out the patch? diff --git a/kernel/ucount.c b/kernel/ucount.c index bb51849e6375..f23f906f4f62 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -201,11 +201,14 @@ void put_ucounts(struct ucounts *ucounts) { unsigned long flags; - if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { + spin_lock_irqsave(&ucounts_lock, flags); + if (atomic_dec_and_test(&ucounts->count)) { hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); kfree(ucounts); + return; } + spin_unlock_irqrestore(&ucounts_lock, flags); } static inline bool atomic_long_inc_below(atomic_long_t *v, int u) -- Rgrds, legion ^ permalink raw reply related [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-29 17:36 ` Alexey Gladkov @ 2021-09-29 21:39 ` Jordan Glover -1 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-29 21:39 UTC (permalink / raw) To: Alexey Gladkov Cc: ebiederm, LKML, linux-mm\\@kvack.org, containers\\@lists.linux-foundation.org, Yu Zhao On Wednesday, September 29th, 2021 at 5:36 PM, Alexey Gladkov <legion@kernel.org> wrote: > On Tue, Sep 28, 2021 at 01:40:48PM +0000, Jordan Glover wrote: > > > On Thursday, September 16th, 2021 at 5:30 PM, ebiederm@xmission.com wrote: > > > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > > > > > Heh, it jut happened again. This time closing firefox alone had such > > > > > > > > effect: > > > > > > Ok. It looks like he have a couple of folks seeing issues here. > > > > > > I thought we had all of the issues sorted out for the release of v5.14, > > > > > > but it looks like there is still some little bug left. > > > > > > If Alex doesn't beat me to it I will see if I can come up with a > > > > > > debugging patch to make it easy to help track down where the reference > > > > > > count is going wrong. It will be a little bit as my brain is mush at > > > > > > the moment. > > > > > > Eric > > > > As the issue persist in 5.14.7 I would be very interested in such patch. > > > > For now the thing is mostly reproducible when I close several tabs in ff then > > > > close the browser in short period of time. When I close tabs then wait out > > > > a bit then close the browser it doesn't happen so I guess some interrupted > > > > cleanup triggers it. > > I'm still investigating, but I would like to rule out one option. > > Could you check out the patch? Thx, I added it to my kernel and will report in few days. Does this patch try to fix the issue or make it easier to track? Jordan > diff --git a/kernel/ucount.c b/kernel/ucount.c > > index bb51849e6375..f23f906f4f62 100644 > > --- a/kernel/ucount.c > > +++ b/kernel/ucount.c > > @@ -201,11 +201,14 @@ void put_ucounts(struct ucounts *ucounts) > > { > > unsigned long flags; > > - if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { > > > > - spin_lock_irqsave(&ucounts_lock, flags); > > > - if (atomic_dec_and_test(&ucounts->count)) { > > hlist_del_init(&ucounts->node); > > spin_unlock_irqrestore(&ucounts_lock, flags); > kfree(ucounts); > > > - return; > } > > > - spin_unlock_irqrestore(&ucounts_lock, flags); > > > > } > > static inline bool atomic_long_inc_below(atomic_long_t *v, int u) > > --------------------------------------------------------------------- > > Rgrds, legion ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-29 21:39 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-09-29 21:39 UTC (permalink / raw) To: Alexey Gladkov Cc: ebiederm, LKML, linux-mm\\@kvack.org, containers\\@lists.linux-foundation.org, Yu Zhao On Wednesday, September 29th, 2021 at 5:36 PM, Alexey Gladkov <legion@kernel.org> wrote: > On Tue, Sep 28, 2021 at 01:40:48PM +0000, Jordan Glover wrote: > > > On Thursday, September 16th, 2021 at 5:30 PM, ebiederm@xmission.com wrote: > > > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > > > > > Heh, it jut happened again. This time closing firefox alone had such > > > > > > > > effect: > > > > > > Ok. It looks like he have a couple of folks seeing issues here. > > > > > > I thought we had all of the issues sorted out for the release of v5.14, > > > > > > but it looks like there is still some little bug left. > > > > > > If Alex doesn't beat me to it I will see if I can come up with a > > > > > > debugging patch to make it easy to help track down where the reference > > > > > > count is going wrong. It will be a little bit as my brain is mush at > > > > > > the moment. > > > > > > Eric > > > > As the issue persist in 5.14.7 I would be very interested in such patch. > > > > For now the thing is mostly reproducible when I close several tabs in ff then > > > > close the browser in short period of time. When I close tabs then wait out > > > > a bit then close the browser it doesn't happen so I guess some interrupted > > > > cleanup triggers it. > > I'm still investigating, but I would like to rule out one option. > > Could you check out the patch? Thx, I added it to my kernel and will report in few days. Does this patch try to fix the issue or make it easier to track? Jordan > diff --git a/kernel/ucount.c b/kernel/ucount.c > > index bb51849e6375..f23f906f4f62 100644 > > --- a/kernel/ucount.c > > +++ b/kernel/ucount.c > > @@ -201,11 +201,14 @@ void put_ucounts(struct ucounts *ucounts) > > { > > unsigned long flags; > > - if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { > > > > - spin_lock_irqsave(&ucounts_lock, flags); > > > - if (atomic_dec_and_test(&ucounts->count)) { > > hlist_del_init(&ucounts->node); > > spin_unlock_irqrestore(&ucounts_lock, flags); > kfree(ucounts); > > > - return; > } > > > - spin_unlock_irqrestore(&ucounts_lock, flags); > > > > } > > static inline bool atomic_long_inc_below(atomic_long_t *v, int u) > > --------------------------------------------------------------------- > > Rgrds, legion ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-29 21:39 ` Jordan Glover (?) @ 2021-09-30 13:06 ` Alexey Gladkov 2021-09-30 22:27 ` Yu Zhao -1 siblings, 1 reply; 70+ messages in thread From: Alexey Gladkov @ 2021-09-30 13:06 UTC (permalink / raw) To: Jordan Glover; +Cc: ebiederm, LKML, linux-mm, containers, Yu Zhao On Wed, Sep 29, 2021 at 09:39:06PM +0000, Jordan Glover wrote: > > I'm still investigating, but I would like to rule out one option. > > > > Could you check out the patch? > > > Thx, I added it to my kernel and will report in few days. > Does this patch try to fix the issue or make it easier to track? I suspect the error is caused by a race between allow_ucounts() and put_ucounts(). I think this patch could solve the problem. -- Rgrds, legion ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-30 13:06 ` Alexey Gladkov @ 2021-09-30 22:27 ` Yu Zhao 0 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-09-30 22:27 UTC (permalink / raw) To: Alexey Gladkov; +Cc: Jordan Glover, ebiederm, LKML, linux-mm, containers On Thu, Sep 30, 2021 at 7:06 AM Alexey Gladkov <legion@kernel.org> wrote: > > On Wed, Sep 29, 2021 at 09:39:06PM +0000, Jordan Glover wrote: > > > I'm still investigating, but I would like to rule out one option. > > > > > > Could you check out the patch? > > > > > > Thx, I added it to my kernel and will report in few days. > > Does this patch try to fix the issue or make it easier to track? > > I suspect the error is caused by a race between allow_ucounts() and > put_ucounts(). I think this patch could solve the problem. Thanks for your help. Still can reproduce the problem with the change suggested. [ 7761.885966] ================================================================== [ 7761.893462] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 7761.899491] Write of size 8 at addr ffffff80c537b140 by task kworker/u16:3/10303 [ 7761.907110] [ 7761.908668] CPU: 0 PID: 10303 Comm: kworker/u16:3 Not tainted 5.14.0-lockdep+ #1 [ 7761.916289] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 7761.923021] Workqueue: netns cleanup_net [ 7761.927106] Call trace: [ 7761.929648] dump_backtrace+0x0/0x42c [ 7761.933442] show_stack+0x24/0x30 [ 7761.936878] dump_stack_lvl+0xd0/0x100 [ 7761.940763] print_address_description+0x30/0x304 [ 7761.945628] kasan_report+0x190/0x1d8 [ 7761.949418] kasan_check_range+0x1ac/0x1bc [ 7761.953655] __kasan_check_write+0x44/0x54 [ 7761.957891] dec_ucount+0x50/0xd8 [ 7761.961334] cleanup_net+0x630/0x718 [ 7761.965036] process_one_work+0x7b4/0x10ec [ 7761.969274] worker_thread+0x800/0xcf4 [ 7761.973152] kthread+0x2a8/0x358 [ 7761.976496] ret_from_fork+0x10/0x18 [ 7761.980201] [ 7761.981761] Allocated by task 4840: [ 7761.985366] kasan_save_stack+0x38/0x68 [ 7761.989342] __kasan_kmalloc+0x9c/0xb8 [ 7761.993222] kmem_cache_alloc_trace+0x2a4/0x370 [ 7761.997905] alloc_ucounts+0x150/0x374 [ 7762.001787] set_cred_ucounts+0x198/0x248 [ 7762.005935] __sys_setresuid+0x31c/0x4f8 [ 7762.009993] __arm64_sys_setresuid+0x84/0x98 [ 7762.014410] invoke_syscall+0xd4/0x2c8 [ 7762.018292] el0_svc_common+0x124/0x200 [ 7762.022265] do_el0_svc_compat+0x54/0x64 [ 7762.026325] el0_svc_compat+0x24/0x34 [ 7762.030124] el0t_32_sync_handler+0xc0/0xf0 [ 7762.034451] el0t_32_sync+0x19c/0x1a0 [ 7762.038241] [ 7762.039799] Freed by task 0: [ 7762.042778] kasan_save_stack+0x38/0x68 [ 7762.046747] kasan_set_track+0x28/0x3c [ 7762.050625] kasan_set_free_info+0x28/0x4c [ 7762.054857] ____kasan_slab_free+0x118/0x164 [ 7762.059277] __kasan_slab_free+0x18/0x28 [ 7762.063339] kfree+0x2f8/0x500 [ 7762.066505] put_ucounts+0x11c/0x134 [ 7762.070209] put_cred_rcu+0x1bc/0x35c [ 7762.074006] rcu_core+0xa68/0x1b20 [ 7762.077538] rcu_core_si+0x1c/0x28 [ 7762.081061] __do_softirq+0x4bc/0xedc [ 7762.084851] [ 7762.086401] The buggy address belongs to the object at ffffff80c537b100 [ 7762.086401] which belongs to the cache kmalloc-256 of size 256 [ 7762.099267] The buggy address is located 64 bytes inside of [ 7762.099267] 256-byte region [ffffff80c537b100, ffffff80c537b200) [ 7762.111248] The buggy address belongs to the page: [ 7762.116185] page:fffffffe0314de00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffff80c537ad00 pfn:0x145378 [ 7762.127180] head:fffffffe0314de00 order:3 compound_mapcount:0 compound_pincount:0 [ 7762.134881] flags: 0x8000000000010200(slab|head|zone=2) [ 7762.140286] raw: 8000000000010200 fffffffe02799408 fffffffe02020808 ffffff808000c980 [ 7762.148263] raw: ffffff80c537ad00 0000000000200004 00000001ffffffff 0000000000000000 [ 7762.156228] page dumped because: kasan: bad access detected [ 7762.161974] [ 7762.163532] Memory state around the buggy address: [ 7762.168475] ffffff80c537b000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7762.175915] ffffff80c537b080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7762.183346] >ffffff80c537b100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7762.190774] ^ [ 7762.196258] ffffff80c537b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7762.203689] ffffff80c537b200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7762.211125] ================================================================== ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-09-30 22:27 ` Yu Zhao 0 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-09-30 22:27 UTC (permalink / raw) To: Alexey Gladkov; +Cc: Jordan Glover, ebiederm, LKML, linux-mm, containers On Thu, Sep 30, 2021 at 7:06 AM Alexey Gladkov <legion@kernel.org> wrote: > > On Wed, Sep 29, 2021 at 09:39:06PM +0000, Jordan Glover wrote: > > > I'm still investigating, but I would like to rule out one option. > > > > > > Could you check out the patch? > > > > > > Thx, I added it to my kernel and will report in few days. > > Does this patch try to fix the issue or make it easier to track? > > I suspect the error is caused by a race between allow_ucounts() and > put_ucounts(). I think this patch could solve the problem. Thanks for your help. Still can reproduce the problem with the change suggested. [ 7761.885966] ================================================================== [ 7761.893462] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 7761.899491] Write of size 8 at addr ffffff80c537b140 by task kworker/u16:3/10303 [ 7761.907110] [ 7761.908668] CPU: 0 PID: 10303 Comm: kworker/u16:3 Not tainted 5.14.0-lockdep+ #1 [ 7761.916289] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 7761.923021] Workqueue: netns cleanup_net [ 7761.927106] Call trace: [ 7761.929648] dump_backtrace+0x0/0x42c [ 7761.933442] show_stack+0x24/0x30 [ 7761.936878] dump_stack_lvl+0xd0/0x100 [ 7761.940763] print_address_description+0x30/0x304 [ 7761.945628] kasan_report+0x190/0x1d8 [ 7761.949418] kasan_check_range+0x1ac/0x1bc [ 7761.953655] __kasan_check_write+0x44/0x54 [ 7761.957891] dec_ucount+0x50/0xd8 [ 7761.961334] cleanup_net+0x630/0x718 [ 7761.965036] process_one_work+0x7b4/0x10ec [ 7761.969274] worker_thread+0x800/0xcf4 [ 7761.973152] kthread+0x2a8/0x358 [ 7761.976496] ret_from_fork+0x10/0x18 [ 7761.980201] [ 7761.981761] Allocated by task 4840: [ 7761.985366] kasan_save_stack+0x38/0x68 [ 7761.989342] __kasan_kmalloc+0x9c/0xb8 [ 7761.993222] kmem_cache_alloc_trace+0x2a4/0x370 [ 7761.997905] alloc_ucounts+0x150/0x374 [ 7762.001787] set_cred_ucounts+0x198/0x248 [ 7762.005935] __sys_setresuid+0x31c/0x4f8 [ 7762.009993] __arm64_sys_setresuid+0x84/0x98 [ 7762.014410] invoke_syscall+0xd4/0x2c8 [ 7762.018292] el0_svc_common+0x124/0x200 [ 7762.022265] do_el0_svc_compat+0x54/0x64 [ 7762.026325] el0_svc_compat+0x24/0x34 [ 7762.030124] el0t_32_sync_handler+0xc0/0xf0 [ 7762.034451] el0t_32_sync+0x19c/0x1a0 [ 7762.038241] [ 7762.039799] Freed by task 0: [ 7762.042778] kasan_save_stack+0x38/0x68 [ 7762.046747] kasan_set_track+0x28/0x3c [ 7762.050625] kasan_set_free_info+0x28/0x4c [ 7762.054857] ____kasan_slab_free+0x118/0x164 [ 7762.059277] __kasan_slab_free+0x18/0x28 [ 7762.063339] kfree+0x2f8/0x500 [ 7762.066505] put_ucounts+0x11c/0x134 [ 7762.070209] put_cred_rcu+0x1bc/0x35c [ 7762.074006] rcu_core+0xa68/0x1b20 [ 7762.077538] rcu_core_si+0x1c/0x28 [ 7762.081061] __do_softirq+0x4bc/0xedc [ 7762.084851] [ 7762.086401] The buggy address belongs to the object at ffffff80c537b100 [ 7762.086401] which belongs to the cache kmalloc-256 of size 256 [ 7762.099267] The buggy address is located 64 bytes inside of [ 7762.099267] 256-byte region [ffffff80c537b100, ffffff80c537b200) [ 7762.111248] The buggy address belongs to the page: [ 7762.116185] page:fffffffe0314de00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffff80c537ad00 pfn:0x145378 [ 7762.127180] head:fffffffe0314de00 order:3 compound_mapcount:0 compound_pincount:0 [ 7762.134881] flags: 0x8000000000010200(slab|head|zone=2) [ 7762.140286] raw: 8000000000010200 fffffffe02799408 fffffffe02020808 ffffff808000c980 [ 7762.148263] raw: ffffff80c537ad00 0000000000200004 00000001ffffffff 0000000000000000 [ 7762.156228] page dumped because: kasan: bad access detected [ 7762.161974] [ 7762.163532] Memory state around the buggy address: [ 7762.168475] ffffff80c537b000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7762.175915] ffffff80c537b080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7762.183346] >ffffff80c537b100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7762.190774] ^ [ 7762.196258] ffffff80c537b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7762.203689] ffffff80c537b200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7762.211125] ================================================================== ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-30 22:27 ` Yu Zhao (?) @ 2021-10-04 17:10 ` Eric W. Biederman 2021-10-04 17:19 ` Eric W. Biederman -1 siblings, 1 reply; 70+ messages in thread From: Eric W. Biederman @ 2021-10-04 17:10 UTC (permalink / raw) To: Yu Zhao Cc: Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers, Rune Kleveland Adding Rune Kleveland to the discussion as he also seems to have reproduced the issue. Alex and I have been starring at the code and the reports and this bug is hiding well. Here is what we have figured out so far. Both the warning from free_user_ns calling dec_ucount that Jordan Glover reported and the KASAN error that Yu Zhao has reported appear to have the same cause. Using a ucounts structure after it has been freed and reallocated as something else. I have just skimmed through the recent report from Rune Kleveland and it appears also to be a use after free. Especially since the second failure in the log is slub complaining about trying to free the ucounts data structure. We looked through the users of put_ucounts and we don't see any obvious buggy users that would be freeing the data structure early. Alex has tried to reproduce this so far is not having any luck. Folks can you tell what compiler versions you are using and share your kernel config with us? That might help. The little debug diff below is my guess of what is happening. If the folks who can reproduce this issue can try the patch below and let me know if the warnings fire that would be appreciated. It is still not enough to track down the bug but at least it will confirm my current hypothesis about how things look before there is a use of memory after it is freed. Thank you, Eric diff --git a/kernel/cred.c b/kernel/cred.c index f784e08c2fbd..e7ffaa3cf5a6 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -120,6 +120,12 @@ static void put_cred_rcu(struct rcu_head *rcu) if (cred->group_info) put_group_info(cred->group_info); free_uid(cred->user); +#if 1 + if ((cred->ucounts == cred->user_ns->ucounts) && + (atomic_read(&cred->ucounts->count) == 1)) { + WARN_ONCE(1, "put_cred_rcu: ucount count 1\n"); + } +#endif if (cred->ucounts) put_ucounts(cred->ucounts); put_user_ns(cred->user_ns); diff --git a/kernel/exit.c b/kernel/exit.c index 91a43e57a32e..60fd88b34c1a 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -743,6 +743,13 @@ void __noreturn do_exit(long code) if (unlikely(!tsk->pid)) panic("Attempted to kill the idle task!"); +#if 1 + if ((tsk->cred->ucounts == tsk->cred->user_ns->ucounts) && + (atomic_read(tsk->cred->ucounts->count) == 1)) { + WARN_ONCE(1, "do_exit: ucount count 1\n"); + } +#endif + /* * If do_exit is called because this processes oopsed, it's possible * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before ^ permalink raw reply related [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-04 17:10 ` Eric W. Biederman @ 2021-10-04 17:19 ` Eric W. Biederman 2021-10-04 21:34 ` Yu Zhao ` (3 more replies) 0 siblings, 4 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-04 17:19 UTC (permalink / raw) To: Yu Zhao Cc: Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers, Rune Kleveland ebiederm@xmission.com (Eric W. Biederman) writes: > Adding Rune Kleveland to the discussion as he also seems to have > reproduced the issue. > > Alex and I have been starring at the code and the reports and this > bug is hiding well. Here is what we have figured out so far. > > Both the warning from free_user_ns calling dec_ucount that Jordan Glover > reported and the KASAN error that Yu Zhao has reported appear to have > the same cause. Using a ucounts structure after it has been freed and > reallocated as something else. > > I have just skimmed through the recent report from Rune Kleveland > and it appears also to be a use after free. Especially since the > second failure in the log is slub complaining about trying to free > the ucounts data structure. > > We looked through the users of put_ucounts and we don't see any obvious > buggy users that would be freeing the data structure early. > > Alex has tried to reproduce this so far is not having any luck. > Folks can you tell what compiler versions you are using and share your > kernel config with us? That might help. > > The little debug diff below is my guess of what is happening. If the > folks who can reproduce this issue can try the patch below and let me > know if the warnings fire that would be appreciated. It is still not > enough to track down the bug but at least it will confirm my current > hypothesis about how things look before there is a use of memory after > it is freed. Bah. Scratch that test patch. I just double checked myself and cred->ucounts and cred->user_ns->ucounts should never be equal, as the user namespace is counted in it's parent user namespace. That observation now tells me I have a parent user namespace that went corrupt. Back to the drawing board. > Thank you, > Eric > > diff --git a/kernel/cred.c b/kernel/cred.c > index f784e08c2fbd..e7ffaa3cf5a6 100644 > --- a/kernel/cred.c > +++ b/kernel/cred.c > @@ -120,6 +120,12 @@ static void put_cred_rcu(struct rcu_head *rcu) > if (cred->group_info) > put_group_info(cred->group_info); > free_uid(cred->user); > +#if 1 > + if ((cred->ucounts == cred->user_ns->ucounts) && > + (atomic_read(&cred->ucounts->count) == 1)) { > + WARN_ONCE(1, "put_cred_rcu: ucount count 1\n"); > + } > +#endif > if (cred->ucounts) > put_ucounts(cred->ucounts); > put_user_ns(cred->user_ns); > diff --git a/kernel/exit.c b/kernel/exit.c > index 91a43e57a32e..60fd88b34c1a 100644 > --- a/kernel/exit.c > +++ b/kernel/exit.c > @@ -743,6 +743,13 @@ void __noreturn do_exit(long code) > if (unlikely(!tsk->pid)) > panic("Attempted to kill the idle task!"); > > +#if 1 > + if ((tsk->cred->ucounts == tsk->cred->user_ns->ucounts) && > + (atomic_read(tsk->cred->ucounts->count) == 1)) { > + WARN_ONCE(1, "do_exit: ucount count 1\n"); > + } > +#endif > + > /* > * If do_exit is called because this processes oopsed, it's possible > * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-04 17:19 ` Eric W. Biederman @ 2021-10-04 21:34 ` Yu Zhao 2021-10-06 7:57 ` Rune Kleveland ` (2 subsequent siblings) 3 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-10-04 21:34 UTC (permalink / raw) To: Eric W. Biederman Cc: Alexey Gladkov, Jordan Glover, LKML, Linux-MM, containers\@lists.linux-foundation.org, Rune Kleveland [-- Attachment #1: Type: text/plain, Size: 1889 bytes --] On Mon, Oct 4, 2021 at 11:19 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > ebiederm@xmission.com (Eric W. Biederman) writes: > > > Adding Rune Kleveland to the discussion as he also seems to have > > reproduced the issue. > > > > Alex and I have been starring at the code and the reports and this > > bug is hiding well. Here is what we have figured out so far. > > > > Both the warning from free_user_ns calling dec_ucount that Jordan Glover > > reported and the KASAN error that Yu Zhao has reported appear to have > > the same cause. Using a ucounts structure after it has been freed and > > reallocated as something else. > > > > I have just skimmed through the recent report from Rune Kleveland > > and it appears also to be a use after free. Especially since the > > second failure in the log is slub complaining about trying to free > > the ucounts data structure. > > > > We looked through the users of put_ucounts and we don't see any obvious > > buggy users that would be freeing the data structure early. > > > > Alex has tried to reproduce this so far is not having any luck. > > Folks can you tell what compiler versions you are using and share your > > kernel config with us? That might help. Thanks. Per your request: $ aarch64-cros-linux-gnu-clang -v Chromium OS 12.0_pre422132_p20210405-r9 clang version 13.0.0 (/var/tmp/portage/sys-devel/llvm-12.0_pre422132_p20210405-r9/work/llvm-12.0_pre422132_p20210405/clang cd442157cff4aad209ae532cbf031abbe10bc1df) Target: aarch64-cros-linux-gnu Thread model: posix InstalledDir: /usr/bin Found candidate GCC installation: /usr/bin/../lib/gcc/aarch64-cros-linux-gnu/10.2.0 Found candidate GCC installation: /usr/bin/../lib64/gcc/aarch64-cros-linux-gnu/10.2.0 Selected GCC installation: /usr/bin/../lib64/gcc/aarch64-cros-linux-gnu/10.2.0 Candidate multilib: .;@m64 Selected multilib: .;@m64 Kernel config attached. [-- Attachment #2: kernel.config --] [-- Type: application/octet-stream, Size: 189953 bytes --] # # Automatically generated file; DO NOT EDIT. # Linux/arm64 5.14.0 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Chromium OS 12.0_pre422132_p20210405-r9 clang version 13.0.0 (/var/tmp/portage/sys-devel/llvm-12.0_pre422132_p20210405-r9/work/llvm-12.0_pre422132_p20210405/clang cd442157cff4aad209ae532cbf031abbe10bc1df)" CONFIG_GCC_VERSION=0 CONFIG_CC_IS_CLANG=y CONFIG_CLANG_VERSION=130000 CONFIG_AS_IS_LLVM=y CONFIG_AS_VERSION=130000 CONFIG_LD_VERSION=0 CONFIG_LD_IS_LLD=y CONFIG_LLD_VERSION=130000 CONFIG_CC_HAS_ASM_GOTO=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CONSTRUCTORS=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y # # General setup # CONFIG_INIT_ENV_ARG_LIMIT=32 # CONFIG_COMPILE_TEST is not set CONFIG_LOCALVERSION="-lockdep" # CONFIG_LOCALVERSION_AUTO is not set CONFIG_BUILD_SALT="" CONFIG_DEFAULT_INIT="" CONFIG_DEFAULT_HOSTNAME="localhost" CONFIG_SWAP=y CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y # CONFIG_POSIX_MQUEUE is not set # CONFIG_WATCH_QUEUE is not set CONFIG_CROSS_MEMORY_ATTACH=y # CONFIG_USELIB is not set CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y CONFIG_AUDITSYSCALL=y # # IRQ subsystem # CONFIG_GENERIC_IRQ_PROBE=y CONFIG_GENERIC_IRQ_SHOW=y CONFIG_GENERIC_IRQ_SHOW_LEVEL=y CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y CONFIG_GENERIC_IRQ_MIGRATION=y CONFIG_GENERIC_IRQ_INJECTION=y CONFIG_HARDIRQS_SW_RESEND=y CONFIG_IRQ_DOMAIN=y CONFIG_IRQ_DOMAIN_HIERARCHY=y CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y CONFIG_GENERIC_IRQ_IPI=y CONFIG_GENERIC_MSI_IRQ=y CONFIG_GENERIC_MSI_IRQ_DOMAIN=y CONFIG_IRQ_MSI_IOMMU=y CONFIG_HANDLE_DOMAIN_IRQ=y CONFIG_IRQ_FORCED_THREADING=y CONFIG_SPARSE_IRQ=y CONFIG_GENERIC_IRQ_DEBUGFS=y # end of IRQ subsystem CONFIG_GENERIC_TIME_VSYSCALL=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_ARCH_HAS_TICK_BROADCAST=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y # # Timers subsystem # CONFIG_TICK_ONESHOT=y CONFIG_NO_HZ_COMMON=y # CONFIG_HZ_PERIODIC is not set CONFIG_NO_HZ_IDLE=y # CONFIG_NO_HZ_FULL is not set CONFIG_NO_HZ=y CONFIG_HIGH_RES_TIMERS=y # end of Timers subsystem CONFIG_BPF=y CONFIG_HAVE_EBPF_JIT=y CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y # # BPF subsystem # CONFIG_BPF_SYSCALL=y CONFIG_BPF_JIT=y CONFIG_BPF_JIT_ALWAYS_ON=y CONFIG_BPF_JIT_DEFAULT_ON=y # CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set # CONFIG_BPF_PRELOAD is not set # CONFIG_BPF_LSM is not set # end of BPF subsystem # CONFIG_PREEMPT_NONE is not set # CONFIG_PREEMPT_VOLUNTARY is not set CONFIG_PREEMPT=y CONFIG_PREEMPT_COUNT=y CONFIG_PREEMPTION=y # # CPU/Task time and stats accounting # CONFIG_TICK_CPU_ACCOUNTING=y # CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set # CONFIG_IRQ_TIME_ACCOUNTING is not set CONFIG_SCHED_THERMAL_PRESSURE=y # CONFIG_BSD_PROCESS_ACCT is not set CONFIG_TASKSTATS=y # CONFIG_TASK_DELAY_ACCT is not set CONFIG_TASK_XACCT=y CONFIG_TASK_IO_ACCOUNTING=y CONFIG_PSI=y # CONFIG_PSI_DEFAULT_DISABLED is not set # end of CPU/Task time and stats accounting CONFIG_CPU_ISOLATION=y # # RCU Subsystem # CONFIG_TREE_RCU=y CONFIG_PREEMPT_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y CONFIG_TREE_SRCU=y CONFIG_TASKS_RCU_GENERIC=y CONFIG_TASKS_RCU=y CONFIG_TASKS_RUDE_RCU=y CONFIG_TASKS_TRACE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem CONFIG_IKCONFIG=m CONFIG_IKCONFIG_PROC=y # CONFIG_IKHEADERS is not set CONFIG_LOG_BUF_SHIFT=18 CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13 CONFIG_GENERIC_SCHED_CLOCK=y # # Scheduler features # CONFIG_UCLAMP_TASK=y CONFIG_UCLAMP_BUCKETS_COUNT=5 # end of Scheduler features CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_CC_HAS_INT128=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_CGROUPS=y # CONFIG_MEMCG is not set CONFIG_BLK_CGROUP=y CONFIG_CGROUP_SCHED=y CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_UCLAMP_TASK_GROUP=y # CONFIG_CGROUP_PIDS is not set # CONFIG_CGROUP_RDMA is not set CONFIG_CGROUP_FREEZER=y CONFIG_CPUSETS=y CONFIG_PROC_PID_CPUSET=y CONFIG_CGROUP_DEVICE=y CONFIG_CGROUP_CPUACCT=y # CONFIG_CGROUP_PERF is not set CONFIG_CGROUP_BPF=y # CONFIG_CGROUP_MISC is not set # CONFIG_CGROUP_DEBUG is not set CONFIG_SOCK_CGROUP_DATA=y CONFIG_NAMESPACES=y CONFIG_UTS_NS=y CONFIG_TIME_NS=y CONFIG_IPC_NS=y CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y # CONFIG_CHECKPOINT_RESTORE is not set CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set CONFIG_RELAY=y CONFIG_BLK_DEV_INITRD=y CONFIG_INITRAMFS_SOURCE="" CONFIG_RD_GZIP=y # CONFIG_RD_BZIP2 is not set # CONFIG_RD_LZMA is not set CONFIG_RD_XZ=y # CONFIG_RD_LZO is not set # CONFIG_RD_LZ4 is not set CONFIG_RD_ZSTD=y # CONFIG_BOOT_CONFIG is not set # CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set CONFIG_CC_OPTIMIZE_FOR_SIZE=y CONFIG_LD_ORPHAN_WARN=y CONFIG_SYSCTL=y CONFIG_HAVE_UID16=y CONFIG_SYSCTL_EXCEPTION_TRACE=y CONFIG_EXPERT=y CONFIG_UID16=y CONFIG_MULTIUSER=y # CONFIG_SGETMASK_SYSCALL is not set CONFIG_SYSFS_SYSCALL=y CONFIG_FHANDLE=y CONFIG_POSIX_TIMERS=y CONFIG_PRINTK=y CONFIG_PRINTK_NMI=y CONFIG_BUG=y CONFIG_ELF_CORE=y CONFIG_BASE_FULL=y CONFIG_FUTEX=y CONFIG_FUTEX_PI=y CONFIG_HAVE_FUTEX_CMPXCHG=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y CONFIG_EVENTFD=y CONFIG_SHMEM=y CONFIG_AIO=y CONFIG_IO_URING=y CONFIG_ADVISE_SYSCALLS=y CONFIG_MEMBARRIER=y CONFIG_KALLSYMS=y CONFIG_KALLSYMS_ALL=y CONFIG_KALLSYMS_BASE_RELATIVE=y # CONFIG_USERFAULTFD is not set CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_DEBUG_RSEQ is not set CONFIG_EMBEDDED=y CONFIG_HAVE_PERF_EVENTS=y # CONFIG_PC104 is not set # # Kernel Performance Events And Counters # CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set # end of Kernel Performance Events And Counters CONFIG_VM_EVENT_COUNTERS=y CONFIG_SLUB_DEBUG=y # CONFIG_COMPAT_BRK is not set # CONFIG_SLAB is not set CONFIG_SLUB=y # CONFIG_SLOB is not set CONFIG_SLAB_MERGE_DEFAULT=y # CONFIG_SLAB_FREELIST_RANDOM is not set # CONFIG_SLAB_FREELIST_HARDENED is not set # CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set CONFIG_SLUB_CPU_PARTIAL=y CONFIG_PROFILING=y CONFIG_TRACEPOINTS=y # end of General setup CONFIG_ARM64=y CONFIG_64BIT=y CONFIG_MMU=y CONFIG_ARM64_PAGE_SHIFT=12 CONFIG_ARM64_CONT_PTE_SHIFT=4 CONFIG_ARM64_CONT_PMD_SHIFT=4 CONFIG_ARCH_MMAP_RND_BITS_MIN=18 CONFIG_ARCH_MMAP_RND_BITS_MAX=24 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 CONFIG_NO_IOPORT_MAP=y CONFIG_STACKTRACE_SUPPORT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 CONFIG_LOCKDEP_SUPPORT=y CONFIG_TRACE_IRQFLAGS_SUPPORT=y CONFIG_GENERIC_BUG=y CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y CONFIG_GENERIC_HWEIGHT=y CONFIG_GENERIC_CSUM=y CONFIG_GENERIC_CALIBRATE_DELAY=y CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y CONFIG_SMP=y CONFIG_KERNEL_MODE_NEON=y CONFIG_FIX_EARLYCON_MEM=y CONFIG_PGTABLE_LEVELS=3 CONFIG_ARCH_SUPPORTS_UPROBES=y CONFIG_ARCH_PROC_KCORE_TEXT=y CONFIG_KASAN_SHADOW_OFFSET=0xdfffffc000000000 # # Platform selection # # CONFIG_ARCH_ACTIONS is not set # CONFIG_ARCH_SUNXI is not set # CONFIG_ARCH_ALPINE is not set # CONFIG_ARCH_APPLE is not set # CONFIG_ARCH_BCM2835 is not set # CONFIG_ARCH_BCM4908 is not set # CONFIG_ARCH_BCM_IPROC is not set # CONFIG_ARCH_BERLIN is not set # CONFIG_ARCH_BITMAIN is not set # CONFIG_ARCH_BRCMSTB is not set # CONFIG_ARCH_EXYNOS is not set # CONFIG_ARCH_SPARX5 is not set # CONFIG_ARCH_K3 is not set # CONFIG_ARCH_LAYERSCAPE is not set # CONFIG_ARCH_LG1K is not set # CONFIG_ARCH_HISI is not set # CONFIG_ARCH_KEEMBAY is not set # CONFIG_ARCH_MEDIATEK is not set # CONFIG_ARCH_MESON is not set # CONFIG_ARCH_MVEBU is not set # CONFIG_ARCH_MXC is not set CONFIG_ARCH_QCOM=y # CONFIG_ARCH_REALTEK is not set # CONFIG_ARCH_RENESAS is not set # CONFIG_ARCH_ROCKCHIP is not set # CONFIG_ARCH_S32 is not set # CONFIG_ARCH_SEATTLE is not set # CONFIG_ARCH_INTEL_SOCFPGA is not set # CONFIG_ARCH_SYNQUACER is not set # CONFIG_ARCH_TEGRA is not set # CONFIG_ARCH_SPRD is not set # CONFIG_ARCH_THUNDER is not set # CONFIG_ARCH_THUNDER2 is not set # CONFIG_ARCH_UNIPHIER is not set # CONFIG_ARCH_VEXPRESS is not set # CONFIG_ARCH_VISCONTI is not set # CONFIG_ARCH_XGENE is not set # CONFIG_ARCH_ZYNQMP is not set # end of Platform selection # # Kernel Features # # # ARM errata workarounds via the alternatives framework # # CONFIG_ARM64_ERRATUM_826319 is not set # CONFIG_ARM64_ERRATUM_827319 is not set # CONFIG_ARM64_ERRATUM_824069 is not set # CONFIG_ARM64_ERRATUM_819472 is not set # CONFIG_ARM64_ERRATUM_832075 is not set CONFIG_ARM64_ERRATUM_834220=y CONFIG_ARM64_ERRATUM_845719=y # CONFIG_ARM64_ERRATUM_843419 is not set CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y CONFIG_ARM64_ERRATUM_1024718=y CONFIG_ARM64_ERRATUM_1418040=y CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y CONFIG_ARM64_ERRATUM_1165522=y CONFIG_ARM64_ERRATUM_1319367=y CONFIG_ARM64_ERRATUM_1530923=y CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y CONFIG_ARM64_ERRATUM_1286807=y CONFIG_ARM64_ERRATUM_1463225=y CONFIG_ARM64_ERRATUM_1542419=y CONFIG_ARM64_ERRATUM_1508412=y # CONFIG_CAVIUM_ERRATUM_22375 is not set # CONFIG_CAVIUM_ERRATUM_23154 is not set # CONFIG_CAVIUM_ERRATUM_27456 is not set CONFIG_CAVIUM_ERRATUM_30115=y CONFIG_CAVIUM_TX2_ERRATUM_219=y CONFIG_FUJITSU_ERRATUM_010001=y CONFIG_HISILICON_ERRATUM_161600802=y CONFIG_QCOM_FALKOR_ERRATUM_1003=y CONFIG_QCOM_FALKOR_ERRATUM_1009=y CONFIG_QCOM_QDF2400_ERRATUM_0065=y CONFIG_QCOM_FALKOR_ERRATUM_E1041=y CONFIG_NVIDIA_CARMEL_CNP_ERRATUM=y CONFIG_SOCIONEXT_SYNQUACER_PREITS=y # end of ARM errata workarounds via the alternatives framework CONFIG_ARM64_4K_PAGES=y # CONFIG_ARM64_16K_PAGES is not set # CONFIG_ARM64_64K_PAGES is not set CONFIG_ARM64_VA_BITS_39=y # CONFIG_ARM64_VA_BITS_48 is not set CONFIG_ARM64_VA_BITS=39 CONFIG_ARM64_PA_BITS_48=y CONFIG_ARM64_PA_BITS=48 # CONFIG_CPU_BIG_ENDIAN is not set CONFIG_CPU_LITTLE_ENDIAN=y CONFIG_SCHED_MC=y # CONFIG_SCHED_SMT is not set CONFIG_NR_CPUS=8 CONFIG_HOTPLUG_CPU=y # CONFIG_NUMA is not set # CONFIG_HZ_100 is not set # CONFIG_HZ_250 is not set # CONFIG_HZ_300 is not set CONFIG_HZ_1000=y CONFIG_HZ=1000 CONFIG_SCHED_HRTICK=y CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_HW_PERF_EVENTS=y CONFIG_ARCH_HAS_FILTER_PGPROT=y CONFIG_CC_HAVE_SHADOW_CALL_STACK=y # CONFIG_PARAVIRT is not set # CONFIG_PARAVIRT_TIME_ACCOUNTING is not set # CONFIG_KEXEC is not set # CONFIG_KEXEC_FILE is not set # CONFIG_CRASH_DUMP is not set # CONFIG_XEN is not set CONFIG_FORCE_MAX_ZONEORDER=11 CONFIG_UNMAP_KERNEL_AT_EL0=y CONFIG_RODATA_FULL_DEFAULT_ENABLED=y # CONFIG_ARM64_SW_TTBR0_PAN is not set CONFIG_ARM64_TAGGED_ADDR_ABI=y CONFIG_COMPAT=y CONFIG_KUSER_HELPERS=y CONFIG_COMPAT_VDSO=y CONFIG_THUMB2_COMPAT_VDSO=y CONFIG_ARMV8_DEPRECATED=y CONFIG_SWP_EMULATION=y CONFIG_CP15_BARRIER_EMULATION=y CONFIG_SETEND_EMULATION=y # # ARMv8.1 architectural features # CONFIG_ARM64_HW_AFDBM=y CONFIG_ARM64_PAN=y CONFIG_AS_HAS_LDAPR=y CONFIG_AS_HAS_LSE_ATOMICS=y # end of ARMv8.1 architectural features # # ARMv8.2 architectural features # # CONFIG_ARM64_PMEM is not set CONFIG_ARM64_RAS_EXTN=y CONFIG_ARM64_CNP=y # end of ARMv8.2 architectural features # # ARMv8.3 architectural features # CONFIG_ARM64_PTR_AUTH=y CONFIG_ARM64_PTR_AUTH_KERNEL=y CONFIG_CC_HAS_BRANCH_PROT_PAC_RET=y CONFIG_CC_HAS_SIGN_RETURN_ADDRESS=y CONFIG_AS_HAS_PAC=y CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y # end of ARMv8.3 architectural features # # ARMv8.4 architectural features # CONFIG_ARM64_AMU_EXTN=y CONFIG_AS_HAS_ARMV8_4=y CONFIG_ARM64_TLB_RANGE=y # end of ARMv8.4 architectural features # # ARMv8.5 architectural features # CONFIG_AS_HAS_ARMV8_5=y CONFIG_ARM64_BTI=y CONFIG_ARM64_BTI_KERNEL=y CONFIG_CC_HAS_BRANCH_PROT_PAC_RET_BTI=y CONFIG_ARM64_E0PD=y CONFIG_ARCH_RANDOM=y CONFIG_ARM64_AS_HAS_MTE=y CONFIG_ARM64_MTE=y # end of ARMv8.5 architectural features # # ARMv8.7 architectural features # CONFIG_ARM64_EPAN=y # end of ARMv8.7 architectural features CONFIG_ARM64_SVE=y CONFIG_ARM64_MODULE_PLTS=y # CONFIG_ARM64_PSEUDO_NMI is not set CONFIG_RELOCATABLE=y CONFIG_RANDOMIZE_BASE=y CONFIG_RANDOMIZE_MODULE_REGION_FULL=y # end of Kernel Features # # Boot options # CONFIG_CMDLINE="" # CONFIG_EFI is not set # end of Boot options CONFIG_SYSVIPC_COMPAT=y # # Power management options # CONFIG_SUSPEND=y CONFIG_SUSPEND_FREEZER=y # CONFIG_SUSPEND_SKIP_SYNC is not set # CONFIG_HIBERNATION is not set CONFIG_PM_SLEEP=y CONFIG_PM_SLEEP_SMP=y # CONFIG_PM_AUTOSLEEP is not set CONFIG_PM_WAKELOCKS=y CONFIG_PM_WAKELOCKS_LIMIT=100 CONFIG_PM_WAKELOCKS_GC=y CONFIG_PM=y CONFIG_PM_DEBUG=y CONFIG_PM_ADVANCED_DEBUG=y # CONFIG_PM_TEST_SUSPEND is not set CONFIG_PM_SLEEP_DEBUG=y # CONFIG_DPM_WATCHDOG is not set CONFIG_PM_CLK=y CONFIG_PM_GENERIC_DOMAINS=y # CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set CONFIG_PM_GENERIC_DOMAINS_SLEEP=y CONFIG_PM_GENERIC_DOMAINS_OF=y CONFIG_CPU_PM=y CONFIG_ENERGY_MODEL=y CONFIG_ARCH_HIBERNATION_POSSIBLE=y CONFIG_ARCH_SUSPEND_POSSIBLE=y # end of Power management options # # CPU Power Management # # # CPU Idle # CONFIG_CPU_IDLE=y CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y CONFIG_CPU_IDLE_GOV_LADDER=y CONFIG_CPU_IDLE_GOV_MENU=y # CONFIG_CPU_IDLE_GOV_TEO is not set CONFIG_DT_IDLE_STATES=y # # ARM CPU Idle Drivers # CONFIG_ARM_CPUIDLE=y CONFIG_ARM_PSCI_CPUIDLE=y CONFIG_ARM_PSCI_CPUIDLE_DOMAIN=y # end of ARM CPU Idle Drivers # end of CPU Idle # # CPU Frequency scaling # CONFIG_CPU_FREQ=y CONFIG_CPU_FREQ_GOV_ATTR_SET=y CONFIG_CPU_FREQ_GOV_COMMON=y CONFIG_CPU_FREQ_STAT=y # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y CONFIG_CPU_FREQ_GOV_PERFORMANCE=y CONFIG_CPU_FREQ_GOV_POWERSAVE=y CONFIG_CPU_FREQ_GOV_USERSPACE=y CONFIG_CPU_FREQ_GOV_ONDEMAND=y CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y # # CPU frequency scaling drivers # CONFIG_CPUFREQ_DT=y CONFIG_CPUFREQ_DT_PLATDEV=y # CONFIG_ARM_QCOM_CPUFREQ_NVMEM is not set CONFIG_ARM_QCOM_CPUFREQ_HW=y # end of CPU Frequency scaling # end of CPU Power Management # # Firmware Drivers # # CONFIG_ARM_SCMI_PROTOCOL is not set # CONFIG_ARM_SCPI_PROTOCOL is not set # CONFIG_ARM_SDE_INTERFACE is not set # CONFIG_FIRMWARE_MEMMAP is not set CONFIG_QCOM_SCM=y # CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT is not set # CONFIG_ARM_FFA_TRANSPORT is not set CONFIG_GOOGLE_FIRMWARE=y CONFIG_GOOGLE_COREBOOT_TABLE=y CONFIG_GOOGLE_MEMCONSOLE=y CONFIG_GOOGLE_MEMCONSOLE_COREBOOT=y CONFIG_GOOGLE_VPD=y CONFIG_ARM_PSCI_FW=y # CONFIG_ARM_PSCI_CHECKER is not set CONFIG_HAVE_ARM_SMCCC=y CONFIG_HAVE_ARM_SMCCC_DISCOVERY=y CONFIG_ARM_SMCCC_SOC_ID=y # # Tegra firmware driver # # end of Tegra firmware driver # end of Firmware Drivers CONFIG_IRQ_BYPASS_MANAGER=y CONFIG_VIRTUALIZATION=y CONFIG_KVM=y CONFIG_HAVE_KVM_IRQCHIP=y CONFIG_HAVE_KVM_IRQFD=y CONFIG_HAVE_KVM_IRQ_ROUTING=y CONFIG_HAVE_KVM_EVENTFD=y CONFIG_KVM_MMIO=y CONFIG_HAVE_KVM_MSI=y CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y CONFIG_KVM_VFIO=y CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL=y CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y CONFIG_HAVE_KVM_IRQ_BYPASS=y CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE=y CONFIG_ARM64_CRYPTO=y CONFIG_CRYPTO_SHA256_ARM64=y # CONFIG_CRYPTO_SHA512_ARM64 is not set CONFIG_CRYPTO_SHA1_ARM64_CE=y CONFIG_CRYPTO_SHA2_ARM64_CE=y # CONFIG_CRYPTO_SHA512_ARM64_CE is not set # CONFIG_CRYPTO_SHA3_ARM64 is not set # CONFIG_CRYPTO_SM3_ARM64_CE is not set # CONFIG_CRYPTO_SM4_ARM64_CE is not set CONFIG_CRYPTO_GHASH_ARM64_CE=y # CONFIG_CRYPTO_CRCT10DIF_ARM64_CE is not set CONFIG_CRYPTO_AES_ARM64=y CONFIG_CRYPTO_AES_ARM64_CE=y CONFIG_CRYPTO_AES_ARM64_CE_CCM=y CONFIG_CRYPTO_AES_ARM64_CE_BLK=y CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y # CONFIG_CRYPTO_CHACHA20_NEON is not set # CONFIG_CRYPTO_POLY1305_NEON is not set # CONFIG_CRYPTO_NHPOLY1305_NEON is not set # CONFIG_CRYPTO_AES_ARM64_BS is not set # # General architecture-dependent options # # CONFIG_KPROBES is not set # CONFIG_JUMP_LABEL is not set CONFIG_UPROBES=y CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_HAVE_KPROBES=y CONFIG_HAVE_KRETPROBES=y CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y CONFIG_HAVE_NMI=y CONFIG_HAVE_ARCH_TRACEHOOK=y CONFIG_HAVE_DMA_CONTIGUOUS=y CONFIG_GENERIC_SMP_IDLE_THREAD=y CONFIG_GENERIC_IDLE_POLL_SETUP=y CONFIG_ARCH_HAS_FORTIFY_SOURCE=y CONFIG_ARCH_HAS_KEEPINITRD=y CONFIG_ARCH_HAS_SET_MEMORY=y CONFIG_ARCH_HAS_SET_DIRECT_MAP=y CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y CONFIG_ARCH_WANTS_NO_INSTR=y CONFIG_HAVE_ASM_MODVERSIONS=y CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y CONFIG_HAVE_RSEQ=y CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y CONFIG_HAVE_HW_BREAKPOINT=y CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y CONFIG_MMU_GATHER_TABLE_FREE=y CONFIG_MMU_GATHER_RCU_TABLE_FREE=y CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y CONFIG_HAVE_CMPXCHG_LOCAL=y CONFIG_HAVE_CMPXCHG_DOUBLE=y CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y CONFIG_HAVE_ARCH_SECCOMP=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y CONFIG_SECCOMP=y CONFIG_SECCOMP_FILTER=y # CONFIG_SECCOMP_CACHE_DEBUG is not set CONFIG_HAVE_ARCH_STACKLEAK=y CONFIG_HAVE_STACKPROTECTOR=y CONFIG_STACKPROTECTOR=y CONFIG_STACKPROTECTOR_STRONG=y CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK=y # CONFIG_SHADOW_CALL_STACK is not set CONFIG_ARCH_SUPPORTS_LTO_CLANG=y CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y CONFIG_LTO_NONE=y CONFIG_ARCH_SUPPORTS_CFI_CLANG=y CONFIG_HAVE_CONTEXT_TRACKING=y CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y CONFIG_HAVE_MOVE_PUD=y CONFIG_HAVE_MOVE_PMD=y CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y CONFIG_HAVE_ARCH_HUGE_VMAP=y CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y CONFIG_HAVE_MOD_ARCH_SPECIFIC=y CONFIG_MODULES_USE_ELF_RELA=y CONFIG_ARCH_HAS_ELF_RANDOMIZE=y CONFIG_HAVE_ARCH_MMAP_RND_BITS=y CONFIG_ARCH_MMAP_RND_BITS=24 CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y CONFIG_ARCH_MMAP_RND_COMPAT_BITS=16 CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT=y CONFIG_CLONE_BACKWARDS=y CONFIG_OLD_SIGSUSPEND3=y CONFIG_COMPAT_OLD_SIGACTION=y CONFIG_COMPAT_32BIT_TIME=y CONFIG_HAVE_ARCH_VMAP_STACK=y CONFIG_VMAP_STACK=y CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y # CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y CONFIG_STRICT_KERNEL_RWX=y CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y CONFIG_STRICT_MODULE_RWX=y CONFIG_HAVE_ARCH_COMPILER_H=y CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y # CONFIG_LOCK_EVENT_COUNTS is not set CONFIG_ARCH_HAS_RELR=y CONFIG_RELR=y CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y CONFIG_HAVE_ARCH_PFN_VALID=y CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y # # GCOV-based kernel profiling # CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y # end of GCOV-based kernel profiling CONFIG_HAVE_GCC_PLUGINS=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 CONFIG_MODULES=y # CONFIG_MODULE_FORCE_LOAD is not set CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set # CONFIG_MODULE_SIG is not set CONFIG_MODULE_COMPRESS_NONE=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set # CONFIG_MODULE_COMPRESS_ZSTD is not set # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y CONFIG_BLK_SCSI_REQUEST=y CONFIG_BLK_CGROUP_RWSTAT=y CONFIG_BLK_DEV_BSG=y # CONFIG_BLK_DEV_BSGLIB is not set # CONFIG_BLK_DEV_INTEGRITY is not set # CONFIG_BLK_DEV_ZONED is not set # CONFIG_BLK_DEV_THROTTLING is not set # CONFIG_BLK_CMDLINE_PARSER is not set # CONFIG_BLK_WBT is not set # CONFIG_BLK_CGROUP_IOLATENCY is not set # CONFIG_BLK_CGROUP_IOCOST is not set # CONFIG_BLK_CGROUP_IOPRIO is not set CONFIG_BLK_DEBUG_FS=y # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set # # Partition Types # CONFIG_PARTITION_ADVANCED=y # CONFIG_ACORN_PARTITION is not set # CONFIG_AIX_PARTITION is not set # CONFIG_OSF_PARTITION is not set # CONFIG_AMIGA_PARTITION is not set # CONFIG_ATARI_PARTITION is not set CONFIG_MAC_PARTITION=y CONFIG_MSDOS_PARTITION=y # CONFIG_BSD_DISKLABEL is not set # CONFIG_MINIX_SUBPARTITION is not set # CONFIG_SOLARIS_X86_PARTITION is not set # CONFIG_UNIXWARE_DISKLABEL is not set # CONFIG_LDM_PARTITION is not set # CONFIG_SGI_PARTITION is not set # CONFIG_ULTRIX_PARTITION is not set # CONFIG_SUN_PARTITION is not set # CONFIG_KARMA_PARTITION is not set CONFIG_EFI_PARTITION=y # CONFIG_SYSV68_PARTITION is not set # CONFIG_CMDLINE_PARTITION is not set # end of Partition Types CONFIG_BLOCK_COMPAT=y CONFIG_BLK_MQ_VIRTIO=y CONFIG_BLK_PM=y # # IO Schedulers # CONFIG_MQ_IOSCHED_DEADLINE=y CONFIG_MQ_IOSCHED_KYBER=y CONFIG_IOSCHED_BFQ=y CONFIG_BFQ_GROUP_IOSCHED=y # CONFIG_BFQ_CGROUP_DEBUG is not set # end of IO Schedulers CONFIG_PREEMPT_NOTIFIERS=y CONFIG_UNINLINE_SPIN_UNLOCK=y CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y CONFIG_MUTEX_SPIN_ON_OWNER=y CONFIG_RWSEM_SPIN_ON_OWNER=y CONFIG_LOCK_SPIN_ON_OWNER=y CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y CONFIG_QUEUED_SPINLOCKS=y CONFIG_ARCH_USE_QUEUED_RWLOCKS=y CONFIG_QUEUED_RWLOCKS=y CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y CONFIG_FREEZER=y # # Executable file formats # CONFIG_BINFMT_ELF=y CONFIG_COMPAT_BINFMT_ELF=y CONFIG_ARCH_BINFMT_ELF_STATE=y CONFIG_ARCH_HAVE_ELF_PROT=y CONFIG_ARCH_USE_GNU_PROPERTY=y CONFIG_ELFCORE=y CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y CONFIG_BINFMT_SCRIPT=y CONFIG_BINFMT_MISC=y CONFIG_COREDUMP=y # end of Executable file formats # # Memory Management options # CONFIG_SPARSEMEM=y CONFIG_SPARSEMEM_EXTREME=y CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y CONFIG_SPARSEMEM_VMEMMAP=y CONFIG_HAVE_FAST_GUP=y CONFIG_ARCH_KEEP_MEMBLOCK=y CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y # CONFIG_MEMORY_HOTPLUG is not set CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y CONFIG_SPLIT_PTLOCK_CPUS=4 CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y CONFIG_COMPACTION=y # CONFIG_PAGE_REPORTING is not set CONFIG_MIGRATION=y CONFIG_ARCH_ENABLE_THP_MIGRATION=y CONFIG_PHYS_ADDR_T_64BIT=y CONFIG_MMU_NOTIFIER=y # CONFIG_KSM is not set CONFIG_DEFAULT_MMAP_MIN_ADDR=32768 CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y # CONFIG_MEMORY_FAILURE is not set CONFIG_TRANSPARENT_HUGEPAGE=y # CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y # CONFIG_CLEANCACHE is not set # CONFIG_FRONTSWAP is not set # CONFIG_CMA is not set # CONFIG_ZPOOL is not set CONFIG_ZSMALLOC=y # CONFIG_ZSMALLOC_STAT is not set CONFIG_GENERIC_EARLY_IOREMAP=y # CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set # CONFIG_IDLE_PAGE_TRACKING is not set CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y CONFIG_ARCH_HAS_PTE_DEVMAP=y CONFIG_ARCH_HAS_ZONE_DMA_SET=y CONFIG_ZONE_DMA=y CONFIG_ZONE_DMA32=y CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y # CONFIG_PERCPU_STATS is not set # CONFIG_GUP_TEST is not set # CONFIG_READ_ONLY_THP_FOR_FS is not set CONFIG_ARCH_HAS_PTE_SPECIAL=y CONFIG_LRU_GEN=y CONFIG_LRU_GEN_ENABLED=y # CONFIG_LRU_GEN_STATS is not set CONFIG_NR_LRU_GENS=7 CONFIG_TIERS_PER_GEN=4 # end of Memory Management options CONFIG_NET=y CONFIG_COMPAT_NETLINK_MESSAGES=y CONFIG_NET_INGRESS=y CONFIG_NET_EGRESS=y CONFIG_SKB_EXTENSIONS=y # # Networking options # CONFIG_PACKET=y # CONFIG_PACKET_DIAG is not set CONFIG_UNIX=y CONFIG_UNIX_SCM=y # CONFIG_UNIX_DIAG is not set # CONFIG_TLS is not set CONFIG_XFRM=y CONFIG_XFRM_ALGO=y CONFIG_XFRM_USER=y # CONFIG_XFRM_INTERFACE is not set # CONFIG_XFRM_SUB_POLICY is not set # CONFIG_XFRM_MIGRATE is not set # CONFIG_XFRM_STATISTICS is not set CONFIG_XFRM_AH=y CONFIG_XFRM_ESP=y CONFIG_XFRM_IPCOMP=y CONFIG_NET_KEY=y # CONFIG_NET_KEY_MIGRATE is not set # CONFIG_XDP_SOCKETS is not set CONFIG_INET=y CONFIG_IP_MULTICAST=y CONFIG_IP_ADVANCED_ROUTER=y # CONFIG_IP_FIB_TRIE_STATS is not set CONFIG_IP_MULTIPLE_TABLES=y CONFIG_IP_ROUTE_MULTIPATH=y CONFIG_IP_ROUTE_VERBOSE=y # CONFIG_IP_PNP is not set # CONFIG_NET_IPIP is not set # CONFIG_NET_IPGRE_DEMUX is not set CONFIG_NET_IP_TUNNEL=m CONFIG_IP_MROUTE_COMMON=y CONFIG_IP_MROUTE=y # CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y CONFIG_SYN_COOKIES=y # CONFIG_NET_IPVTI is not set # CONFIG_NET_FOU is not set # CONFIG_NET_FOU_IP_TUNNELS is not set CONFIG_INET_AH=y CONFIG_INET_ESP=y # CONFIG_INET_ESP_OFFLOAD is not set # CONFIG_INET_ESPINTCP is not set CONFIG_INET_IPCOMP=y CONFIG_INET_XFRM_TUNNEL=y CONFIG_INET_TUNNEL=y CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y CONFIG_INET_UDP_DIAG=y # CONFIG_INET_RAW_DIAG is not set CONFIG_INET_DIAG_DESTROY=y CONFIG_TCP_CONG_ADVANCED=y # CONFIG_TCP_CONG_BIC is not set CONFIG_TCP_CONG_CUBIC=y # CONFIG_TCP_CONG_WESTWOOD is not set # CONFIG_TCP_CONG_HTCP is not set # CONFIG_TCP_CONG_HSTCP is not set # CONFIG_TCP_CONG_HYBLA is not set # CONFIG_TCP_CONG_VEGAS is not set # CONFIG_TCP_CONG_NV is not set # CONFIG_TCP_CONG_SCALABLE is not set CONFIG_TCP_CONG_LP=m # CONFIG_TCP_CONG_VENO is not set # CONFIG_TCP_CONG_YEAH is not set # CONFIG_TCP_CONG_ILLINOIS is not set # CONFIG_TCP_CONG_DCTCP is not set # CONFIG_TCP_CONG_CDG is not set # CONFIG_TCP_CONG_BBR is not set CONFIG_DEFAULT_CUBIC=y # CONFIG_DEFAULT_RENO is not set CONFIG_DEFAULT_TCP_CONG="cubic" CONFIG_TCP_MD5SIG=y CONFIG_IPV6=y CONFIG_IPV6_ROUTER_PREF=y CONFIG_IPV6_ROUTE_INFO=y # CONFIG_IPV6_OPTIMISTIC_DAD is not set CONFIG_INET6_AH=m CONFIG_INET6_ESP=m # CONFIG_INET6_ESP_OFFLOAD is not set # CONFIG_INET6_ESPINTCP is not set # CONFIG_INET6_IPCOMP is not set # CONFIG_IPV6_MIP6 is not set # CONFIG_IPV6_ILA is not set # CONFIG_IPV6_VTI is not set CONFIG_IPV6_SIT=m # CONFIG_IPV6_SIT_6RD is not set CONFIG_IPV6_NDISC_NODETYPE=y # CONFIG_IPV6_TUNNEL is not set CONFIG_IPV6_MULTIPLE_TABLES=y # CONFIG_IPV6_SUBTREES is not set # CONFIG_IPV6_MROUTE is not set # CONFIG_IPV6_SEG6_LWTUNNEL is not set # CONFIG_IPV6_SEG6_HMAC is not set # CONFIG_IPV6_RPL_LWTUNNEL is not set # CONFIG_NETLABEL is not set # CONFIG_MPTCP is not set CONFIG_NETWORK_SECMARK=y CONFIG_NET_PTP_CLASSIFY=y # CONFIG_NETWORK_PHY_TIMESTAMPING is not set CONFIG_NETFILTER=y CONFIG_NETFILTER_ADVANCED=y # CONFIG_BRIDGE_NETFILTER is not set # # Core Netfilter Configuration # CONFIG_NETFILTER_INGRESS=y CONFIG_NETFILTER_NETLINK=y # CONFIG_NETFILTER_NETLINK_ACCT is not set CONFIG_NETFILTER_NETLINK_QUEUE=y CONFIG_NETFILTER_NETLINK_LOG=y # CONFIG_NETFILTER_NETLINK_OSF is not set CONFIG_NF_CONNTRACK=y # CONFIG_NF_LOG_SYSLOG is not set CONFIG_NETFILTER_CONNCOUNT=y CONFIG_NF_CONNTRACK_MARK=y CONFIG_NF_CONNTRACK_SECMARK=y # CONFIG_NF_CONNTRACK_ZONES is not set CONFIG_NF_CONNTRACK_PROCFS=y CONFIG_NF_CONNTRACK_EVENTS=y CONFIG_NF_CONNTRACK_TIMEOUT=y # CONFIG_NF_CONNTRACK_TIMESTAMP is not set # CONFIG_NF_CONNTRACK_LABELS is not set # CONFIG_NF_CT_PROTO_DCCP is not set CONFIG_NF_CT_PROTO_GRE=y # CONFIG_NF_CT_PROTO_SCTP is not set # CONFIG_NF_CT_PROTO_UDPLITE is not set # CONFIG_NF_CONNTRACK_AMANDA is not set CONFIG_NF_CONNTRACK_FTP=m # CONFIG_NF_CONNTRACK_H323 is not set # CONFIG_NF_CONNTRACK_IRC is not set # CONFIG_NF_CONNTRACK_NETBIOS_NS is not set # CONFIG_NF_CONNTRACK_SNMP is not set CONFIG_NF_CONNTRACK_PPTP=y # CONFIG_NF_CONNTRACK_SANE is not set # CONFIG_NF_CONNTRACK_SIP is not set CONFIG_NF_CONNTRACK_TFTP=m CONFIG_NF_CT_NETLINK=y CONFIG_NF_CT_NETLINK_TIMEOUT=y CONFIG_NF_CT_NETLINK_HELPER=y CONFIG_NETFILTER_NETLINK_GLUE_CT=y CONFIG_NF_NAT=y CONFIG_NF_NAT_FTP=m CONFIG_NF_NAT_TFTP=m CONFIG_NF_NAT_REDIRECT=y CONFIG_NF_NAT_MASQUERADE=y # CONFIG_NF_TABLES is not set CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XTABLES_COMPAT=y # # Xtables combined modules # CONFIG_NETFILTER_XT_MARK=y CONFIG_NETFILTER_XT_CONNMARK=y # # Xtables targets # # CONFIG_NETFILTER_XT_TARGET_AUDIT is not set # CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y CONFIG_NETFILTER_XT_TARGET_CONNMARK=y CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y CONFIG_NETFILTER_XT_TARGET_CT=y CONFIG_NETFILTER_XT_TARGET_DSCP=y # CONFIG_NETFILTER_XT_TARGET_HL is not set # CONFIG_NETFILTER_XT_TARGET_HMARK is not set CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y # CONFIG_NETFILTER_XT_TARGET_LED is not set # CONFIG_NETFILTER_XT_TARGET_LOG is not set CONFIG_NETFILTER_XT_TARGET_MARK=y CONFIG_NETFILTER_XT_NAT=y # CONFIG_NETFILTER_XT_TARGET_NETMAP is not set CONFIG_NETFILTER_XT_TARGET_NFLOG=y CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y # CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set CONFIG_NETFILTER_XT_TARGET_REDIRECT=y CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m # CONFIG_NETFILTER_XT_TARGET_TEE is not set CONFIG_NETFILTER_XT_TARGET_TPROXY=y CONFIG_NETFILTER_XT_TARGET_TRACE=y CONFIG_NETFILTER_XT_TARGET_SECMARK=y CONFIG_NETFILTER_XT_TARGET_TCPMSS=y # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set # # Xtables matches # CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y CONFIG_NETFILTER_XT_MATCH_BPF=y # CONFIG_NETFILTER_XT_MATCH_CGROUP is not set # CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set CONFIG_NETFILTER_XT_MATCH_COMMENT=y # CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set # CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y CONFIG_NETFILTER_XT_MATCH_CONNMARK=y CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_CPU is not set # CONFIG_NETFILTER_XT_MATCH_DCCP is not set # CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set CONFIG_NETFILTER_XT_MATCH_DSCP=y # CONFIG_NETFILTER_XT_MATCH_ECN is not set # CONFIG_NETFILTER_XT_MATCH_ESP is not set CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y CONFIG_NETFILTER_XT_MATCH_HELPER=y # CONFIG_NETFILTER_XT_MATCH_HL is not set # CONFIG_NETFILTER_XT_MATCH_IPCOMP is not set CONFIG_NETFILTER_XT_MATCH_IPRANGE=y # CONFIG_NETFILTER_XT_MATCH_L2TP is not set CONFIG_NETFILTER_XT_MATCH_LENGTH=y CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=y CONFIG_NETFILTER_XT_MATCH_MARK=y # CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set # CONFIG_NETFILTER_XT_MATCH_OSF is not set # CONFIG_NETFILTER_XT_MATCH_OWNER is not set CONFIG_NETFILTER_XT_MATCH_POLICY=y CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y CONFIG_NETFILTER_XT_MATCH_QUOTA=y # CONFIG_NETFILTER_XT_MATCH_RATEEST is not set # CONFIG_NETFILTER_XT_MATCH_REALM is not set # CONFIG_NETFILTER_XT_MATCH_RECENT is not set # CONFIG_NETFILTER_XT_MATCH_SCTP is not set CONFIG_NETFILTER_XT_MATCH_SOCKET=y CONFIG_NETFILTER_XT_MATCH_STATE=y CONFIG_NETFILTER_XT_MATCH_STATISTIC=y CONFIG_NETFILTER_XT_MATCH_STRING=y # CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set CONFIG_NETFILTER_XT_MATCH_TIME=y CONFIG_NETFILTER_XT_MATCH_U32=y # end of Core Netfilter Configuration # CONFIG_IP_SET is not set # CONFIG_IP_VS is not set # # IP: Netfilter Configuration # CONFIG_NF_DEFRAG_IPV4=y CONFIG_NF_SOCKET_IPV4=y CONFIG_NF_TPROXY_IPV4=y # CONFIG_NF_DUP_IPV4 is not set # CONFIG_NF_LOG_ARP is not set # CONFIG_NF_LOG_IPV4 is not set CONFIG_NF_REJECT_IPV4=y CONFIG_NF_NAT_PPTP=y CONFIG_IP_NF_IPTABLES=y # CONFIG_IP_NF_MATCH_AH is not set # CONFIG_IP_NF_MATCH_ECN is not set # CONFIG_IP_NF_MATCH_RPFILTER is not set # CONFIG_IP_NF_MATCH_TTL is not set CONFIG_IP_NF_FILTER=y CONFIG_IP_NF_TARGET_REJECT=y # CONFIG_IP_NF_TARGET_SYNPROXY is not set CONFIG_IP_NF_NAT=y CONFIG_IP_NF_TARGET_MASQUERADE=m # CONFIG_IP_NF_TARGET_NETMAP is not set CONFIG_IP_NF_TARGET_REDIRECT=m CONFIG_IP_NF_MANGLE=y # CONFIG_IP_NF_TARGET_CLUSTERIP is not set # CONFIG_IP_NF_TARGET_ECN is not set # CONFIG_IP_NF_TARGET_TTL is not set CONFIG_IP_NF_RAW=y CONFIG_IP_NF_SECURITY=y # CONFIG_IP_NF_ARPTABLES is not set # end of IP: Netfilter Configuration # # IPv6: Netfilter Configuration # CONFIG_NF_SOCKET_IPV6=y CONFIG_NF_TPROXY_IPV6=y # CONFIG_NF_DUP_IPV6 is not set CONFIG_NF_REJECT_IPV6=y # CONFIG_NF_LOG_IPV6 is not set CONFIG_IP6_NF_IPTABLES=y # CONFIG_IP6_NF_MATCH_AH is not set # CONFIG_IP6_NF_MATCH_EUI64 is not set # CONFIG_IP6_NF_MATCH_FRAG is not set # CONFIG_IP6_NF_MATCH_OPTS is not set # CONFIG_IP6_NF_MATCH_HL is not set CONFIG_IP6_NF_MATCH_IPV6HEADER=m # CONFIG_IP6_NF_MATCH_MH is not set CONFIG_IP6_NF_MATCH_RPFILTER=y # CONFIG_IP6_NF_MATCH_RT is not set # CONFIG_IP6_NF_MATCH_SRH is not set # CONFIG_IP6_NF_TARGET_HL is not set CONFIG_IP6_NF_FILTER=y CONFIG_IP6_NF_TARGET_REJECT=m # CONFIG_IP6_NF_TARGET_SYNPROXY is not set CONFIG_IP6_NF_MANGLE=y CONFIG_IP6_NF_RAW=y # CONFIG_IP6_NF_SECURITY is not set CONFIG_IP6_NF_NAT=m CONFIG_IP6_NF_TARGET_MASQUERADE=m # CONFIG_IP6_NF_TARGET_NPT is not set # end of IPv6: Netfilter Configuration CONFIG_NF_DEFRAG_IPV6=y # CONFIG_NF_CONNTRACK_BRIDGE is not set # CONFIG_BRIDGE_NF_EBTABLES is not set # CONFIG_BPFILTER is not set # CONFIG_IP_DCCP is not set # CONFIG_IP_SCTP is not set # CONFIG_RDS is not set # CONFIG_TIPC is not set # CONFIG_ATM is not set # CONFIG_L2TP is not set CONFIG_STP=m CONFIG_BRIDGE=m CONFIG_BRIDGE_IGMP_SNOOPING=y # CONFIG_BRIDGE_VLAN_FILTERING is not set # CONFIG_BRIDGE_MRP is not set # CONFIG_BRIDGE_CFM is not set # CONFIG_NET_DSA is not set CONFIG_VLAN_8021Q=m # CONFIG_VLAN_8021Q_GVRP is not set # CONFIG_VLAN_8021Q_MVRP is not set # CONFIG_DECNET is not set CONFIG_LLC=m # CONFIG_LLC2 is not set # CONFIG_ATALK is not set # CONFIG_X25 is not set # CONFIG_LAPB is not set # CONFIG_PHONET is not set # CONFIG_6LOWPAN is not set # CONFIG_IEEE802154 is not set CONFIG_NET_SCHED=y # # Queueing/Scheduling # # CONFIG_NET_SCH_CBQ is not set CONFIG_NET_SCH_HTB=m # CONFIG_NET_SCH_HFSC is not set # CONFIG_NET_SCH_PRIO is not set # CONFIG_NET_SCH_MULTIQ is not set # CONFIG_NET_SCH_RED is not set # CONFIG_NET_SCH_SFB is not set # CONFIG_NET_SCH_SFQ is not set # CONFIG_NET_SCH_TEQL is not set # CONFIG_NET_SCH_TBF is not set # CONFIG_NET_SCH_CBS is not set # CONFIG_NET_SCH_ETF is not set # CONFIG_NET_SCH_TAPRIO is not set # CONFIG_NET_SCH_GRED is not set # CONFIG_NET_SCH_DSMARK is not set # CONFIG_NET_SCH_NETEM is not set # CONFIG_NET_SCH_DRR is not set # CONFIG_NET_SCH_MQPRIO is not set # CONFIG_NET_SCH_SKBPRIO is not set # CONFIG_NET_SCH_CHOKE is not set # CONFIG_NET_SCH_QFQ is not set CONFIG_NET_SCH_CODEL=m CONFIG_NET_SCH_FQ_CODEL=m # CONFIG_NET_SCH_CAKE is not set # CONFIG_NET_SCH_FQ is not set # CONFIG_NET_SCH_HHF is not set # CONFIG_NET_SCH_PIE is not set CONFIG_NET_SCH_INGRESS=m # CONFIG_NET_SCH_PLUG is not set # CONFIG_NET_SCH_ETS is not set # CONFIG_NET_SCH_DEFAULT is not set # # Classification # CONFIG_NET_CLS=y # CONFIG_NET_CLS_BASIC is not set # CONFIG_NET_CLS_TCINDEX is not set # CONFIG_NET_CLS_ROUTE4 is not set # CONFIG_NET_CLS_FW is not set CONFIG_NET_CLS_U32=m # CONFIG_CLS_U32_PERF is not set CONFIG_CLS_U32_MARK=y # CONFIG_NET_CLS_RSVP is not set # CONFIG_NET_CLS_RSVP6 is not set # CONFIG_NET_CLS_FLOW is not set # CONFIG_NET_CLS_CGROUP is not set # CONFIG_NET_CLS_BPF is not set # CONFIG_NET_CLS_FLOWER is not set # CONFIG_NET_CLS_MATCHALL is not set # CONFIG_NET_EMATCH is not set CONFIG_NET_CLS_ACT=y CONFIG_NET_ACT_POLICE=y CONFIG_NET_ACT_GACT=y # CONFIG_GACT_PROB is not set # CONFIG_NET_ACT_MIRRED is not set # CONFIG_NET_ACT_SAMPLE is not set # CONFIG_NET_ACT_IPT is not set # CONFIG_NET_ACT_NAT is not set # CONFIG_NET_ACT_PEDIT is not set # CONFIG_NET_ACT_SIMP is not set # CONFIG_NET_ACT_SKBEDIT is not set # CONFIG_NET_ACT_CSUM is not set # CONFIG_NET_ACT_MPLS is not set # CONFIG_NET_ACT_VLAN is not set # CONFIG_NET_ACT_BPF is not set # CONFIG_NET_ACT_CONNMARK is not set # CONFIG_NET_ACT_CTINFO is not set # CONFIG_NET_ACT_SKBMOD is not set # CONFIG_NET_ACT_IFE is not set # CONFIG_NET_ACT_TUNNEL_KEY is not set # CONFIG_NET_ACT_GATE is not set # CONFIG_NET_TC_SKB_EXT is not set CONFIG_NET_SCH_FIFO=y # CONFIG_DCB is not set CONFIG_DNS_RESOLVER=m # CONFIG_BATMAN_ADV is not set # CONFIG_OPENVSWITCH is not set CONFIG_VSOCKETS=m CONFIG_VSOCKETS_DIAG=m CONFIG_VSOCKETS_LOOPBACK=m # CONFIG_VIRTIO_VSOCKETS is not set CONFIG_VIRTIO_VSOCKETS_COMMON=m # CONFIG_NETLINK_DIAG is not set # CONFIG_MPLS is not set # CONFIG_NET_NSH is not set # CONFIG_HSR is not set # CONFIG_NET_SWITCHDEV is not set # CONFIG_NET_L3_MASTER_DEV is not set CONFIG_QRTR=y CONFIG_QRTR_SMD=y CONFIG_QRTR_TUN=y # CONFIG_NET_NCSI is not set CONFIG_PCPU_DEV_REFCNT=y CONFIG_RPS=y CONFIG_RFS_ACCEL=y CONFIG_SOCK_RX_QUEUE_MAPPING=y CONFIG_XPS=y # CONFIG_CGROUP_NET_PRIO is not set # CONFIG_CGROUP_NET_CLASSID is not set CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y # CONFIG_BPF_STREAM_PARSER is not set CONFIG_NET_FLOW_LIMIT=y # # Network testing # # CONFIG_NET_PKTGEN is not set # CONFIG_NET_DROP_MONITOR is not set # end of Network testing # end of Networking options # CONFIG_HAMRADIO is not set # CONFIG_CAN is not set CONFIG_BT=m CONFIG_BT_BREDR=y CONFIG_BT_RFCOMM=m # CONFIG_BT_RFCOMM_TTY is not set # CONFIG_BT_BNEP is not set CONFIG_BT_HIDP=m # CONFIG_BT_HS is not set CONFIG_BT_LE=y # CONFIG_BT_LEDS is not set # CONFIG_BT_MSFTEXT is not set # CONFIG_BT_AOSPEXT is not set CONFIG_BT_DEBUGFS=y # CONFIG_BT_SELFTEST is not set # # Bluetooth device drivers # CONFIG_BT_INTEL=m CONFIG_BT_BCM=m CONFIG_BT_RTL=m CONFIG_BT_QCA=m CONFIG_BT_HCIBTUSB=m CONFIG_BT_HCIBTUSB_AUTOSUSPEND=y CONFIG_BT_HCIBTUSB_BCM=y # CONFIG_BT_HCIBTUSB_MTK is not set CONFIG_BT_HCIBTUSB_RTL=y CONFIG_BT_HCIBTSDIO=m CONFIG_BT_HCIUART=m CONFIG_BT_HCIUART_SERDEV=y CONFIG_BT_HCIUART_H4=y # CONFIG_BT_HCIUART_NOKIA is not set # CONFIG_BT_HCIUART_BCSP is not set # CONFIG_BT_HCIUART_ATH3K is not set # CONFIG_BT_HCIUART_LL is not set # CONFIG_BT_HCIUART_3WIRE is not set # CONFIG_BT_HCIUART_INTEL is not set # CONFIG_BT_HCIUART_BCM is not set # CONFIG_BT_HCIUART_RTL is not set CONFIG_BT_HCIUART_QCA=y # CONFIG_BT_HCIUART_AG6XX is not set # CONFIG_BT_HCIUART_MRVL is not set # CONFIG_BT_HCIBCM203X is not set # CONFIG_BT_HCIBPA10X is not set CONFIG_BT_HCIBFUSB=m CONFIG_BT_HCIVHCI=m CONFIG_BT_MRVL=m CONFIG_BT_MRVL_SDIO=m # CONFIG_BT_ATH3K is not set # CONFIG_BT_MTKSDIO is not set # CONFIG_BT_MTKUART is not set # CONFIG_BT_VIRTIO is not set # end of Bluetooth device drivers # CONFIG_AF_RXRPC is not set # CONFIG_AF_KCM is not set CONFIG_FIB_RULES=y CONFIG_WIRELESS=y CONFIG_WIRELESS_EXT=y CONFIG_WEXT_CORE=y CONFIG_WEXT_PROC=y CONFIG_WEXT_SPY=y CONFIG_WEXT_PRIV=y CONFIG_CFG80211=m CONFIG_NL80211_TESTMODE=y # CONFIG_CFG80211_DEVELOPER_WARNINGS is not set CONFIG_CFG80211_CERTIFICATION_ONUS=y # CONFIG_CFG80211_REQUIRE_SIGNED_REGDB is not set # CONFIG_CFG80211_REG_CELLULAR_HINTS is not set # CONFIG_CFG80211_REG_RELAX_NO_IR is not set CONFIG_CFG80211_DEFAULT_PS=y CONFIG_CFG80211_DEBUGFS=y CONFIG_CFG80211_CRDA_SUPPORT=y CONFIG_CFG80211_WEXT=y CONFIG_LIB80211=m CONFIG_LIB80211_CRYPT_WEP=m CONFIG_LIB80211_CRYPT_CCMP=m CONFIG_LIB80211_CRYPT_TKIP=m # CONFIG_LIB80211_DEBUG is not set CONFIG_MAC80211=m CONFIG_MAC80211_HAS_RC=y CONFIG_MAC80211_RC_MINSTREL=y CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y CONFIG_MAC80211_RC_DEFAULT="minstrel_ht" # CONFIG_MAC80211_MESH is not set CONFIG_MAC80211_LEDS=y CONFIG_MAC80211_DEBUGFS=y # CONFIG_MAC80211_MESSAGE_TRACING is not set CONFIG_MAC80211_DEBUG_MENU=y # CONFIG_MAC80211_NOINLINE is not set CONFIG_MAC80211_VERBOSE_DEBUG=y # CONFIG_MAC80211_MLME_DEBUG is not set # CONFIG_MAC80211_STA_DEBUG is not set # CONFIG_MAC80211_HT_DEBUG is not set # CONFIG_MAC80211_OCB_DEBUG is not set # CONFIG_MAC80211_IBSS_DEBUG is not set # CONFIG_MAC80211_PS_DEBUG is not set # CONFIG_MAC80211_TDLS_DEBUG is not set # CONFIG_MAC80211_DEBUG_COUNTERS is not set CONFIG_MAC80211_STA_HASH_MAX_SIZE=0 CONFIG_RFKILL=y CONFIG_RFKILL_LEDS=y # CONFIG_RFKILL_INPUT is not set # CONFIG_RFKILL_GPIO is not set # CONFIG_NET_9P is not set # CONFIG_CAIF is not set # CONFIG_CEPH_LIB is not set # CONFIG_NFC is not set # CONFIG_PSAMPLE is not set # CONFIG_NET_IFE is not set # CONFIG_LWTUNNEL is not set CONFIG_DST_CACHE=y CONFIG_GRO_CELLS=y CONFIG_NET_SELFTESTS=y CONFIG_NET_SOCK_MSG=y CONFIG_PAGE_POOL=y # CONFIG_FAILOVER is not set CONFIG_ETHTOOL_NETLINK=y # # Device Drivers # CONFIG_ARM_AMBA=y CONFIG_HAVE_PCI=y # CONFIG_PCI is not set # CONFIG_PCCARD is not set # # Generic Driver Options # CONFIG_AUXILIARY_BUS=y # CONFIG_UEVENT_HELPER is not set CONFIG_DEVTMPFS=y CONFIG_DEVTMPFS_MOUNT=y CONFIG_STANDALONE=y CONFIG_PREVENT_FIRMWARE_BUILD=y # # Firmware loader # CONFIG_FW_LOADER=y CONFIG_EXTRA_FIRMWARE="" # CONFIG_FW_LOADER_USER_HELPER is not set # CONFIG_FW_LOADER_COMPRESS is not set CONFIG_FW_CACHE=y # end of Firmware loader CONFIG_WANT_DEV_COREDUMP=y CONFIG_ALLOW_DEV_COREDUMP=y CONFIG_DEV_COREDUMP=y # CONFIG_DEBUG_DRIVER is not set CONFIG_DEBUG_DEVRES=y # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set CONFIG_TEST_ASYNC_DRIVER_PROBE=m CONFIG_GENERIC_CPU_AUTOPROBE=y CONFIG_GENERIC_CPU_VULNERABILITIES=y CONFIG_SOC_BUS=y CONFIG_REGMAP=y CONFIG_REGMAP_I2C=y CONFIG_REGMAP_SPI=y CONFIG_REGMAP_SPMI=y CONFIG_REGMAP_MMIO=y CONFIG_REGMAP_IRQ=y CONFIG_DMA_SHARED_BUFFER=y # CONFIG_DMA_FENCE_TRACE is not set CONFIG_GENERIC_ARCH_TOPOLOGY=y # end of Generic Driver Options # # Bus devices # # CONFIG_BRCMSTB_GISB_ARB is not set # CONFIG_MOXTET is not set # CONFIG_QCOM_EBI2 is not set # CONFIG_SIMPLE_PM_BUS is not set # CONFIG_VEXPRESS_CONFIG is not set # CONFIG_MHI_BUS is not set # end of Bus devices CONFIG_CONNECTOR=y CONFIG_PROC_EVENTS=y # CONFIG_GNSS is not set CONFIG_MTD=y # CONFIG_MTD_TESTS is not set # # Partition parsers # # CONFIG_MTD_AR7_PARTS is not set CONFIG_MTD_CMDLINE_PARTS=y CONFIG_MTD_OF_PARTS=y # CONFIG_MTD_AFS_PARTS is not set # CONFIG_MTD_REDBOOT_PARTS is not set # CONFIG_MTD_QCOMSMEM_PARTS is not set # end of Partition parsers # # User Modules And Translation Layers # # CONFIG_MTD_BLOCK is not set # CONFIG_MTD_BLOCK_RO is not set # CONFIG_FTL is not set # CONFIG_NFTL is not set # CONFIG_INFTL is not set # CONFIG_RFD_FTL is not set # CONFIG_SSFDC is not set # CONFIG_SM_FTL is not set # CONFIG_MTD_OOPS is not set # CONFIG_MTD_SWAP is not set CONFIG_MTD_PARTITIONED_MASTER=y # # RAM/ROM/Flash chip drivers # # CONFIG_MTD_CFI is not set # CONFIG_MTD_JEDECPROBE is not set CONFIG_MTD_MAP_BANK_WIDTH_1=y CONFIG_MTD_MAP_BANK_WIDTH_2=y CONFIG_MTD_MAP_BANK_WIDTH_4=y CONFIG_MTD_CFI_I1=y CONFIG_MTD_CFI_I2=y # CONFIG_MTD_RAM is not set # CONFIG_MTD_ROM is not set # CONFIG_MTD_ABSENT is not set # end of RAM/ROM/Flash chip drivers # # Mapping drivers for chip access # # CONFIG_MTD_COMPLEX_MAPPINGS is not set # CONFIG_MTD_PLATRAM is not set # end of Mapping drivers for chip access # # Self-contained MTD device drivers # # CONFIG_MTD_DATAFLASH is not set # CONFIG_MTD_MCHP23K256 is not set # CONFIG_MTD_MCHP48L640 is not set # CONFIG_MTD_SST25L is not set # CONFIG_MTD_SLRAM is not set # CONFIG_MTD_PHRAM is not set # CONFIG_MTD_MTDRAM is not set # CONFIG_MTD_BLOCK2MTD is not set # # Disk-On-Chip Device Drivers # # CONFIG_MTD_DOCG3 is not set # end of Self-contained MTD device drivers # # NAND # # CONFIG_MTD_ONENAND is not set # CONFIG_MTD_RAW_NAND is not set # CONFIG_MTD_SPI_NAND is not set # # ECC engine support # # CONFIG_MTD_NAND_ECC_SW_HAMMING is not set # CONFIG_MTD_NAND_ECC_SW_BCH is not set # end of ECC engine support # end of NAND # # LPDDR & LPDDR2 PCM memory drivers # # CONFIG_MTD_LPDDR is not set # end of LPDDR & LPDDR2 PCM memory drivers CONFIG_MTD_SPI_NOR=y CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y # CONFIG_MTD_SPI_NOR_SWP_DISABLE is not set CONFIG_MTD_SPI_NOR_SWP_DISABLE_ON_VOLATILE=y # CONFIG_MTD_SPI_NOR_SWP_KEEP is not set # CONFIG_MTD_UBI is not set # CONFIG_MTD_HYPERBUS is not set CONFIG_DTC=y CONFIG_OF=y # CONFIG_OF_UNITTEST is not set CONFIG_OF_FLATTREE=y CONFIG_OF_EARLY_FLATTREE=y CONFIG_OF_KOBJ=y CONFIG_OF_ADDRESS=y CONFIG_OF_IRQ=y CONFIG_OF_NET=y CONFIG_OF_RESERVED_MEM=y # CONFIG_OF_OVERLAY is not set CONFIG_PARPORT=y # CONFIG_PARPORT_AX88796 is not set # CONFIG_PARPORT_1284 is not set CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_NULL_BLK is not set CONFIG_CDROM=m CONFIG_ZRAM=m CONFIG_ZRAM_DEF_COMP_LZORLE=y # CONFIG_ZRAM_DEF_COMP_LZO is not set CONFIG_ZRAM_DEF_COMP="lzo-rle" # CONFIG_ZRAM_WRITEBACK is not set # CONFIG_ZRAM_MEMORY_TRACKING is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 # CONFIG_BLK_DEV_CRYPTOLOOP is not set # CONFIG_BLK_DEV_DRBD is not set # CONFIG_BLK_DEV_NBD is not set # CONFIG_BLK_DEV_RAM is not set # CONFIG_CDROM_PKTCDVD is not set # CONFIG_ATA_OVER_ETH is not set # CONFIG_VIRTIO_BLK is not set # CONFIG_BLK_DEV_RBD is not set # # NVME Support # # CONFIG_NVME_FC is not set # CONFIG_NVME_TCP is not set # CONFIG_NVME_TARGET is not set # end of NVME Support # # Misc devices # # CONFIG_AD525X_DPOT is not set # CONFIG_DUMMY_IRQ is not set # CONFIG_ICS932S401 is not set # CONFIG_ENCLOSURE_SERVICES is not set # CONFIG_QCOM_COINCELL is not set # CONFIG_QCOM_FASTRPC is not set # CONFIG_APDS9802ALS is not set # CONFIG_ISL29003 is not set # CONFIG_ISL29020 is not set # CONFIG_SENSORS_TSL2550 is not set # CONFIG_SENSORS_BH1770 is not set # CONFIG_SENSORS_APDS990X is not set # CONFIG_HMC6352 is not set # CONFIG_DS1682 is not set # CONFIG_LATTICE_ECP3_CONFIG is not set # CONFIG_SRAM is not set # CONFIG_XILINX_SDFEC is not set # CONFIG_HISI_HIKEY_USB is not set # CONFIG_C2PORT is not set # # EEPROM support # # CONFIG_EEPROM_AT24 is not set # CONFIG_EEPROM_AT25 is not set # CONFIG_EEPROM_LEGACY is not set # CONFIG_EEPROM_MAX6875 is not set # CONFIG_EEPROM_93CX6 is not set # CONFIG_EEPROM_93XX46 is not set # CONFIG_EEPROM_IDT_89HPESX is not set # CONFIG_EEPROM_EE1004 is not set # end of EEPROM support # # Texas Instruments shared transport line discipline # # CONFIG_TI_ST is not set # end of Texas Instruments shared transport line discipline # CONFIG_SENSORS_LIS3_SPI is not set # CONFIG_SENSORS_LIS3_I2C is not set # CONFIG_ALTERA_STAPL is not set # CONFIG_ECHO is not set # CONFIG_MISC_RTSX_USB is not set # CONFIG_UACCE is not set # CONFIG_PVPANIC is not set # end of Misc devices # # SCSI device support # CONFIG_SCSI_MOD=y # CONFIG_RAID_ATTRS is not set CONFIG_SCSI=y CONFIG_SCSI_DMA=y CONFIG_SCSI_PROC_FS=y # # SCSI support type (disk, tape, CD-ROM) # CONFIG_BLK_DEV_SD=y # CONFIG_CHR_DEV_ST is not set CONFIG_BLK_DEV_SR=m # CONFIG_CHR_DEV_SG is not set # CONFIG_CHR_DEV_SCH is not set # CONFIG_SCSI_CONSTANTS is not set # CONFIG_SCSI_LOGGING is not set CONFIG_SCSI_SCAN_ASYNC=y # # SCSI Transports # CONFIG_SCSI_SPI_ATTRS=y # CONFIG_SCSI_FC_ATTRS is not set # CONFIG_SCSI_ISCSI_ATTRS is not set # CONFIG_SCSI_SAS_ATTRS is not set # CONFIG_SCSI_SAS_LIBSAS is not set # CONFIG_SCSI_SRP_ATTRS is not set # end of SCSI Transports CONFIG_SCSI_LOWLEVEL=y # CONFIG_ISCSI_TCP is not set # CONFIG_ISCSI_BOOT_SYSFS is not set CONFIG_SCSI_UFSHCD=y CONFIG_SCSI_UFSHCD_PLATFORM=y # CONFIG_SCSI_UFS_CDNS_PLATFORM is not set # CONFIG_SCSI_UFS_DWC_TC_PLATFORM is not set CONFIG_SCSI_UFS_QCOM=y # CONFIG_SCSI_UFS_BSG is not set # CONFIG_SCSI_DEBUG is not set # CONFIG_SCSI_VIRTIO is not set # CONFIG_SCSI_DH is not set # end of SCSI device support CONFIG_HAVE_PATA_PLATFORM=y # CONFIG_ATA is not set CONFIG_MD=y # CONFIG_BLK_DEV_MD is not set # CONFIG_BCACHE is not set CONFIG_BLK_DEV_DM_BUILTIN=y CONFIG_BLK_DEV_DM=y # CONFIG_DM_DEBUG is not set CONFIG_DM_BUFIO=y # CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING is not set CONFIG_DM_BIO_PRISON=y CONFIG_DM_PERSISTENT_DATA=y # CONFIG_DM_UNSTRIPED is not set CONFIG_DM_CRYPT=y # CONFIG_DM_SNAPSHOT is not set CONFIG_DM_THIN_PROVISIONING=y # CONFIG_DM_CACHE is not set # CONFIG_DM_WRITECACHE is not set # CONFIG_DM_EBS is not set # CONFIG_DM_ERA is not set # CONFIG_DM_CLONE is not set # CONFIG_DM_MIRROR is not set # CONFIG_DM_RAID is not set # CONFIG_DM_ZERO is not set # CONFIG_DM_MULTIPATH is not set # CONFIG_DM_DELAY is not set # CONFIG_DM_DUST is not set CONFIG_DM_INIT=y # CONFIG_DM_UEVENT is not set CONFIG_DM_FLAKEY=m CONFIG_DM_VERITY=y # CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG is not set # CONFIG_DM_VERITY_FEC is not set # CONFIG_DM_SWITCH is not set # CONFIG_DM_LOG_WRITES is not set # CONFIG_DM_INTEGRITY is not set # CONFIG_TARGET_CORE is not set CONFIG_NETDEVICES=y CONFIG_MII=m CONFIG_NET_CORE=y # CONFIG_BONDING is not set # CONFIG_DUMMY is not set # CONFIG_WIREGUARD is not set # CONFIG_EQUALIZER is not set # CONFIG_IFB is not set # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set # CONFIG_IPVLAN is not set # CONFIG_VXLAN is not set # CONFIG_GENEVE is not set # CONFIG_BAREUDP is not set # CONFIG_GTP is not set # CONFIG_MACSEC is not set # CONFIG_NETCONSOLE is not set CONFIG_TUN=m # CONFIG_TUN_VNET_CROSS_LE is not set CONFIG_VETH=m # CONFIG_VIRTIO_NET is not set # CONFIG_NLMON is not set # CONFIG_VSOCKMON is not set CONFIG_ETHERNET=y CONFIG_NET_VENDOR_ALACRITECH=y # CONFIG_ALTERA_TSE is not set CONFIG_NET_VENDOR_AMAZON=y CONFIG_NET_VENDOR_AMD=y # CONFIG_AMD_XGBE is not set CONFIG_NET_VENDOR_AQUANTIA=y CONFIG_NET_VENDOR_ARC=y CONFIG_NET_VENDOR_BROADCOM=y # CONFIG_B44 is not set # CONFIG_BCMGENET is not set # CONFIG_SYSTEMPORT is not set CONFIG_NET_VENDOR_CADENCE=y # CONFIG_MACB is not set CONFIG_NET_VENDOR_CAVIUM=y CONFIG_NET_VENDOR_CORTINA=y # CONFIG_GEMINI_ETHERNET is not set # CONFIG_DNET is not set CONFIG_NET_VENDOR_EZCHIP=y # CONFIG_EZCHIP_NPS_MANAGEMENT_ENET is not set CONFIG_NET_VENDOR_GOOGLE=y CONFIG_NET_VENDOR_HISILICON=y # CONFIG_HIX5HD2_GMAC is not set # CONFIG_HISI_FEMAC is not set # CONFIG_HIP04_ETH is not set # CONFIG_HNS_DSAF is not set # CONFIG_HNS_ENET is not set CONFIG_NET_VENDOR_HUAWEI=y CONFIG_NET_VENDOR_I825XX=y CONFIG_NET_VENDOR_INTEL=y CONFIG_NET_VENDOR_MICROSOFT=y CONFIG_NET_VENDOR_MARVELL=y # CONFIG_MVMDIO is not set CONFIG_NET_VENDOR_MELLANOX=y # CONFIG_MLXSW_CORE is not set # CONFIG_MLXFW is not set CONFIG_NET_VENDOR_MICREL=y # CONFIG_KS8842 is not set # CONFIG_KS8851 is not set # CONFIG_KS8851_MLL is not set CONFIG_NET_VENDOR_MICROCHIP=y # CONFIG_ENC28J60 is not set # CONFIG_ENCX24J600 is not set CONFIG_NET_VENDOR_MICROSEMI=y CONFIG_NET_VENDOR_NATSEMI=y CONFIG_NET_VENDOR_NETRONOME=y CONFIG_NET_VENDOR_NI=y # CONFIG_NI_XGE_MANAGEMENT_ENET is not set CONFIG_NET_VENDOR_8390=y # CONFIG_ETHOC is not set CONFIG_NET_VENDOR_PENSANDO=y CONFIG_NET_VENDOR_QUALCOMM=y # CONFIG_QCA7000_SPI is not set # CONFIG_QCA7000_UART is not set # CONFIG_QCOM_EMAC is not set CONFIG_RMNET=y CONFIG_NET_VENDOR_RENESAS=y CONFIG_NET_VENDOR_ROCKER=y CONFIG_NET_VENDOR_SAMSUNG=y # CONFIG_SXGBE_ETH is not set CONFIG_NET_VENDOR_SEEQ=y CONFIG_NET_VENDOR_SOLARFLARE=y CONFIG_NET_VENDOR_SMSC=y # CONFIG_SMC91X is not set # CONFIG_SMSC911X is not set CONFIG_NET_VENDOR_SOCIONEXT=y CONFIG_NET_VENDOR_STMICRO=y CONFIG_STMMAC_ETH=m # CONFIG_STMMAC_SELFTESTS is not set CONFIG_STMMAC_PLATFORM=m # CONFIG_DWMAC_DWC_QOS_ETH is not set CONFIG_DWMAC_GENERIC=m # CONFIG_DWMAC_IPQ806X is not set CONFIG_DWMAC_QCOM_ETHQOS=m # CONFIG_DWMAC_INTEL_PLAT is not set CONFIG_NET_VENDOR_SYNOPSYS=y # CONFIG_DWC_XLGMAC is not set CONFIG_NET_VENDOR_VIA=y # CONFIG_VIA_VELOCITY is not set CONFIG_NET_VENDOR_WIZNET=y # CONFIG_WIZNET_W5100 is not set # CONFIG_WIZNET_W5300 is not set CONFIG_NET_VENDOR_XILINX=y # CONFIG_XILINX_EMACLITE is not set # CONFIG_XILINX_AXI_EMAC is not set # CONFIG_XILINX_LL_TEMAC is not set CONFIG_QCOM_IPA=m CONFIG_PHYLINK=m CONFIG_PHYLIB=y CONFIG_SWPHY=y # CONFIG_LED_TRIGGER_PHY is not set CONFIG_FIXED_PHY=y # CONFIG_SFP is not set # # MII PHY device drivers # # CONFIG_AMD_PHY is not set # CONFIG_ADIN_PHY is not set # CONFIG_AQUANTIA_PHY is not set CONFIG_AX88796B_PHY=m # CONFIG_BROADCOM_PHY is not set # CONFIG_BCM54140_PHY is not set # CONFIG_BCM7XXX_PHY is not set # CONFIG_BCM84881_PHY is not set # CONFIG_BCM87XX_PHY is not set # CONFIG_CICADA_PHY is not set # CONFIG_CORTINA_PHY is not set # CONFIG_DAVICOM_PHY is not set # CONFIG_ICPLUS_PHY is not set # CONFIG_LXT_PHY is not set # CONFIG_INTEL_XWAY_PHY is not set # CONFIG_LSI_ET1011C_PHY is not set # CONFIG_MARVELL_PHY is not set # CONFIG_MARVELL_10G_PHY is not set # CONFIG_MARVELL_88X2222_PHY is not set # CONFIG_MEDIATEK_GE_PHY is not set # CONFIG_MICREL_PHY is not set # CONFIG_MICROCHIP_PHY is not set # CONFIG_MICROCHIP_T1_PHY is not set # CONFIG_MICROSEMI_PHY is not set # CONFIG_MOTORCOMM_PHY is not set # CONFIG_NATIONAL_PHY is not set # CONFIG_NXP_C45_TJA11XX_PHY is not set # CONFIG_NXP_TJA11XX_PHY is not set # CONFIG_AT803X_PHY is not set # CONFIG_QSEMI_PHY is not set # CONFIG_REALTEK_PHY is not set # CONFIG_RENESAS_PHY is not set # CONFIG_ROCKCHIP_PHY is not set CONFIG_SMSC_PHY=m # CONFIG_STE10XP is not set # CONFIG_TERANETICS_PHY is not set # CONFIG_DP83822_PHY is not set # CONFIG_DP83TC811_PHY is not set # CONFIG_DP83848_PHY is not set # CONFIG_DP83867_PHY is not set # CONFIG_DP83869_PHY is not set # CONFIG_VITESSE_PHY is not set # CONFIG_XILINX_GMII2RGMII is not set # CONFIG_MICREL_KS8995MA is not set CONFIG_MDIO_DEVICE=y CONFIG_MDIO_BUS=y CONFIG_FWNODE_MDIO=y CONFIG_OF_MDIO=y CONFIG_MDIO_DEVRES=y # CONFIG_MDIO_BITBANG is not set # CONFIG_MDIO_BCM_UNIMAC is not set # CONFIG_MDIO_HISI_FEMAC is not set # CONFIG_MDIO_MVUSB is not set # CONFIG_MDIO_MSCC_MIIM is not set # CONFIG_MDIO_OCTEON is not set # CONFIG_MDIO_IPQ4019 is not set # CONFIG_MDIO_IPQ8064 is not set # # MDIO Multiplexers # # CONFIG_MDIO_BUS_MUX_GPIO is not set # CONFIG_MDIO_BUS_MUX_MULTIPLEXER is not set # CONFIG_MDIO_BUS_MUX_MMIOREG is not set # # PCS device drivers # CONFIG_PCS_XPCS=m # end of PCS device drivers # CONFIG_PLIP is not set CONFIG_PPP=y # CONFIG_PPP_BSDCOMP is not set # CONFIG_PPP_DEFLATE is not set # CONFIG_PPP_FILTER is not set CONFIG_PPP_MPPE=y # CONFIG_PPP_MULTILINK is not set # CONFIG_PPPOE is not set CONFIG_PPP_ASYNC=y # CONFIG_PPP_SYNC_TTY is not set # CONFIG_SLIP is not set CONFIG_SLHC=y CONFIG_USB_NET_DRIVERS=y # CONFIG_USB_CATC is not set # CONFIG_USB_KAWETH is not set CONFIG_USB_PEGASUS=m CONFIG_USB_RTL8150=m CONFIG_USB_RTL8152=m # CONFIG_USB_LAN78XX is not set CONFIG_USB_USBNET=m CONFIG_USB_NET_AX8817X=m CONFIG_USB_NET_AX88179_178A=m CONFIG_USB_NET_CDCETHER=m # CONFIG_USB_NET_CDC_EEM is not set CONFIG_USB_NET_CDC_NCM=m # CONFIG_USB_NET_HUAWEI_CDC_NCM is not set CONFIG_USB_NET_CDC_MBIM=m CONFIG_USB_NET_DM9601=m # CONFIG_USB_NET_SR9700 is not set # CONFIG_USB_NET_SR9800 is not set CONFIG_USB_NET_SMSC75XX=m CONFIG_USB_NET_SMSC95XX=m # CONFIG_USB_NET_GL620A is not set CONFIG_USB_NET_NET1080=m # CONFIG_USB_NET_PLUSB is not set CONFIG_USB_NET_MCS7830=m CONFIG_USB_NET_RNDIS_HOST=m # CONFIG_USB_NET_CDC_SUBSET is not set # CONFIG_USB_NET_ZAURUS is not set # CONFIG_USB_NET_CX82310_ETH is not set # CONFIG_USB_NET_KALMIA is not set CONFIG_USB_NET_QMI_WWAN=m # CONFIG_USB_HSO is not set # CONFIG_USB_NET_INT51X1 is not set CONFIG_USB_IPHETH=m # CONFIG_USB_SIERRA_NET is not set # CONFIG_USB_VL600 is not set # CONFIG_USB_NET_CH9200 is not set # CONFIG_USB_NET_AQC111 is not set # CONFIG_USB_RTL8153_ECM is not set CONFIG_WLAN=y CONFIG_WLAN_VENDOR_ADMTEK=y CONFIG_ATH_COMMON=m CONFIG_WLAN_VENDOR_ATH=y # CONFIG_ATH_DEBUG is not set # CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS is not set # CONFIG_ATH9K is not set # CONFIG_ATH9K_HTC is not set # CONFIG_CARL9170 is not set # CONFIG_ATH6KL is not set # CONFIG_AR5523 is not set CONFIG_ATH10K=m CONFIG_ATH10K_CE=y # CONFIG_ATH10K_SDIO is not set # CONFIG_ATH10K_USB is not set CONFIG_ATH10K_SNOC=m CONFIG_ATH10K_DEBUG=y CONFIG_ATH10K_DEBUGFS=y # CONFIG_ATH10K_SPECTRAL is not set # CONFIG_ATH10K_TRACING is not set # CONFIG_ATH10K_DFS_CERTIFIED is not set # CONFIG_WCN36XX is not set # CONFIG_ATH11K is not set CONFIG_WLAN_VENDOR_ATMEL=y # CONFIG_AT76C50X_USB is not set CONFIG_WLAN_VENDOR_BROADCOM=y # CONFIG_B43 is not set # CONFIG_B43LEGACY is not set # CONFIG_BRCMSMAC is not set # CONFIG_BRCMFMAC is not set CONFIG_WLAN_VENDOR_CISCO=y CONFIG_WLAN_VENDOR_INTEL=y CONFIG_WLAN_VENDOR_INTERSIL=y CONFIG_HOSTAP=m CONFIG_HOSTAP_FIRMWARE=y CONFIG_HOSTAP_FIRMWARE_NVRAM=y # CONFIG_P54_COMMON is not set CONFIG_WLAN_VENDOR_MARVELL=y # CONFIG_LIBERTAS is not set CONFIG_LIBERTAS_THINFIRM=m # CONFIG_LIBERTAS_THINFIRM_DEBUG is not set # CONFIG_LIBERTAS_THINFIRM_USB is not set CONFIG_MWIFIEX=m CONFIG_MWIFIEX_SDIO=m # CONFIG_MWIFIEX_USB is not set CONFIG_WLAN_VENDOR_MEDIATEK=y # CONFIG_MT7601U is not set # CONFIG_MT76x0U is not set # CONFIG_MT76x2U is not set # CONFIG_MT7663U is not set # CONFIG_MT7663S is not set CONFIG_WLAN_VENDOR_MICROCHIP=y # CONFIG_WILC1000_SDIO is not set # CONFIG_WILC1000_SPI is not set CONFIG_WLAN_VENDOR_RALINK=y CONFIG_RT2X00=m # CONFIG_RT2500USB is not set # CONFIG_RT73USB is not set CONFIG_RT2800USB=m CONFIG_RT2800USB_RT33XX=y CONFIG_RT2800USB_RT35XX=y CONFIG_RT2800USB_RT3573=y CONFIG_RT2800USB_RT53XX=y CONFIG_RT2800USB_RT55XX=y CONFIG_RT2800USB_UNKNOWN=y CONFIG_RT2800_LIB=m CONFIG_RT2X00_LIB_USB=m CONFIG_RT2X00_LIB=m CONFIG_RT2X00_LIB_FIRMWARE=y CONFIG_RT2X00_LIB_CRYPTO=y CONFIG_RT2X00_LIB_LEDS=y # CONFIG_RT2X00_LIB_DEBUGFS is not set # CONFIG_RT2X00_DEBUG is not set CONFIG_WLAN_VENDOR_REALTEK=y # CONFIG_RTL8187 is not set CONFIG_RTL_CARDS=m # CONFIG_RTL8192CU is not set # CONFIG_RTL8XXXU is not set # CONFIG_RTW88 is not set CONFIG_WLAN_VENDOR_RSI=y # CONFIG_RSI_91X is not set CONFIG_WLAN_VENDOR_ST=y # CONFIG_CW1200 is not set CONFIG_WLAN_VENDOR_TI=y # CONFIG_WL1251 is not set # CONFIG_WL12XX is not set # CONFIG_WL18XX is not set # CONFIG_WLCORE is not set CONFIG_WLAN_VENDOR_ZYDAS=y # CONFIG_USB_ZD1201 is not set # CONFIG_ZD1211RW is not set CONFIG_WLAN_VENDOR_QUANTENNA=y CONFIG_MAC80211_HWSIM=m CONFIG_USB_NET_RNDIS_WLAN=m # CONFIG_VIRT_WIFI is not set # CONFIG_WAN is not set # # Wireless WAN # # CONFIG_WWAN is not set # end of Wireless WAN # CONFIG_NETDEVSIM is not set # CONFIG_NET_FAILOVER is not set # CONFIG_ISDN is not set # CONFIG_NVM is not set # # Input device support # CONFIG_INPUT=y CONFIG_INPUT_LEDS=y CONFIG_INPUT_FF_MEMLESS=y # CONFIG_INPUT_SPARSEKMAP is not set CONFIG_INPUT_MATRIXKMAP=y # # Userland interfaces # # CONFIG_INPUT_MOUSEDEV is not set CONFIG_INPUT_JOYDEV=m CONFIG_INPUT_EVDEV=y # CONFIG_INPUT_EVBUG is not set # # Input Device Drivers # CONFIG_INPUT_KEYBOARD=y # CONFIG_KEYBOARD_ADC is not set # CONFIG_KEYBOARD_ADP5588 is not set # CONFIG_KEYBOARD_ADP5589 is not set # CONFIG_KEYBOARD_ATKBD is not set # CONFIG_KEYBOARD_QT1050 is not set # CONFIG_KEYBOARD_QT1070 is not set # CONFIG_KEYBOARD_QT2160 is not set # CONFIG_KEYBOARD_DLINK_DIR685 is not set # CONFIG_KEYBOARD_LKKBD is not set CONFIG_KEYBOARD_GPIO=y # CONFIG_KEYBOARD_GPIO_POLLED is not set # CONFIG_KEYBOARD_TCA6416 is not set # CONFIG_KEYBOARD_TCA8418 is not set # CONFIG_KEYBOARD_MATRIX is not set # CONFIG_KEYBOARD_LM8323 is not set # CONFIG_KEYBOARD_LM8333 is not set # CONFIG_KEYBOARD_MAX7359 is not set # CONFIG_KEYBOARD_MCS is not set # CONFIG_KEYBOARD_MPR121 is not set # CONFIG_KEYBOARD_NEWTON is not set # CONFIG_KEYBOARD_OPENCORES is not set # CONFIG_KEYBOARD_SAMSUNG is not set # CONFIG_KEYBOARD_STOWAWAY is not set # CONFIG_KEYBOARD_SUNKBD is not set # CONFIG_KEYBOARD_OMAP4 is not set # CONFIG_KEYBOARD_TM2_TOUCHKEY is not set # CONFIG_KEYBOARD_XTKBD is not set CONFIG_KEYBOARD_CROS_EC=y # CONFIG_KEYBOARD_CAP11XX is not set # CONFIG_KEYBOARD_BCM is not set # CONFIG_KEYBOARD_MTK_PMIC is not set CONFIG_INPUT_MOUSE=y # CONFIG_MOUSE_PS2 is not set # CONFIG_MOUSE_SERIAL is not set # CONFIG_MOUSE_APPLETOUCH is not set # CONFIG_MOUSE_BCM5974 is not set CONFIG_MOUSE_CYAPA=y CONFIG_MOUSE_ELAN_I2C=y CONFIG_MOUSE_ELAN_I2C_I2C=y # CONFIG_MOUSE_ELAN_I2C_SMBUS is not set # CONFIG_MOUSE_VSXXXAA is not set # CONFIG_MOUSE_GPIO is not set # CONFIG_MOUSE_SYNAPTICS_I2C is not set # CONFIG_MOUSE_SYNAPTICS_USB is not set CONFIG_INPUT_JOYSTICK=y # CONFIG_JOYSTICK_ANALOG is not set # CONFIG_JOYSTICK_A3D is not set # CONFIG_JOYSTICK_ADC is not set # CONFIG_JOYSTICK_ADI is not set # CONFIG_JOYSTICK_COBRA is not set # CONFIG_JOYSTICK_GF2K is not set # CONFIG_JOYSTICK_GRIP is not set # CONFIG_JOYSTICK_GRIP_MP is not set # CONFIG_JOYSTICK_GUILLEMOT is not set # CONFIG_JOYSTICK_INTERACT is not set # CONFIG_JOYSTICK_SIDEWINDER is not set # CONFIG_JOYSTICK_TMDC is not set CONFIG_JOYSTICK_IFORCE=m CONFIG_JOYSTICK_IFORCE_USB=m # CONFIG_JOYSTICK_IFORCE_232 is not set # CONFIG_JOYSTICK_WARRIOR is not set # CONFIG_JOYSTICK_MAGELLAN is not set # CONFIG_JOYSTICK_SPACEORB is not set # CONFIG_JOYSTICK_SPACEBALL is not set # CONFIG_JOYSTICK_STINGER is not set # CONFIG_JOYSTICK_TWIDJOY is not set # CONFIG_JOYSTICK_ZHENHUA is not set # CONFIG_JOYSTICK_DB9 is not set # CONFIG_JOYSTICK_GAMECON is not set # CONFIG_JOYSTICK_TURBOGRAFX is not set # CONFIG_JOYSTICK_AS5011 is not set # CONFIG_JOYSTICK_JOYDUMP is not set CONFIG_JOYSTICK_XPAD=m CONFIG_JOYSTICK_XPAD_FF=y CONFIG_JOYSTICK_XPAD_LEDS=y # CONFIG_JOYSTICK_WALKERA0701 is not set # CONFIG_JOYSTICK_PSXPAD_SPI is not set # CONFIG_JOYSTICK_PXRC is not set # CONFIG_JOYSTICK_QWIIC is not set # CONFIG_JOYSTICK_FSIA6B is not set CONFIG_INPUT_TABLET=y # CONFIG_TABLET_USB_ACECAD is not set # CONFIG_TABLET_USB_AIPTEK is not set # CONFIG_TABLET_USB_HANWANG is not set # CONFIG_TABLET_USB_KBTAB is not set # CONFIG_TABLET_USB_PEGASUS is not set # CONFIG_TABLET_SERIAL_WACOM4 is not set CONFIG_INPUT_TOUCHSCREEN=y # CONFIG_TOUCHSCREEN_ADS7846 is not set # CONFIG_TOUCHSCREEN_AD7877 is not set # CONFIG_TOUCHSCREEN_AD7879 is not set # CONFIG_TOUCHSCREEN_ADC is not set # CONFIG_TOUCHSCREEN_AR1021_I2C is not set CONFIG_TOUCHSCREEN_ATMEL_MXT=y # CONFIG_TOUCHSCREEN_ATMEL_MXT_T37 is not set # CONFIG_TOUCHSCREEN_AUO_PIXCIR is not set # CONFIG_TOUCHSCREEN_BU21013 is not set # CONFIG_TOUCHSCREEN_BU21029 is not set # CONFIG_TOUCHSCREEN_CHIPONE_ICN8318 is not set # CONFIG_TOUCHSCREEN_CY8CTMA140 is not set # CONFIG_TOUCHSCREEN_CY8CTMG110 is not set # CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set # CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set # CONFIG_TOUCHSCREEN_DYNAPRO is not set # CONFIG_TOUCHSCREEN_HAMPSHIRE is not set # CONFIG_TOUCHSCREEN_EETI is not set # CONFIG_TOUCHSCREEN_EGALAX is not set # CONFIG_TOUCHSCREEN_EGALAX_SERIAL is not set # CONFIG_TOUCHSCREEN_EXC3000 is not set # CONFIG_TOUCHSCREEN_FUJITSU is not set # CONFIG_TOUCHSCREEN_GOODIX is not set # CONFIG_TOUCHSCREEN_HIDEEP is not set # CONFIG_TOUCHSCREEN_HYCON_HY46XX is not set # CONFIG_TOUCHSCREEN_ILI210X is not set # CONFIG_TOUCHSCREEN_ILITEK is not set # CONFIG_TOUCHSCREEN_S6SY761 is not set # CONFIG_TOUCHSCREEN_GUNZE is not set # CONFIG_TOUCHSCREEN_EKTF2127 is not set CONFIG_TOUCHSCREEN_ELAN=y # CONFIG_TOUCHSCREEN_ELO is not set # CONFIG_TOUCHSCREEN_WACOM_W8001 is not set # CONFIG_TOUCHSCREEN_WACOM_I2C is not set # CONFIG_TOUCHSCREEN_MAX11801 is not set # CONFIG_TOUCHSCREEN_MCS5000 is not set # CONFIG_TOUCHSCREEN_MMS114 is not set # CONFIG_TOUCHSCREEN_MELFAS_MIP4 is not set # CONFIG_TOUCHSCREEN_MSG2638 is not set # CONFIG_TOUCHSCREEN_MTOUCH is not set # CONFIG_TOUCHSCREEN_IMX6UL_TSC is not set # CONFIG_TOUCHSCREEN_INEXIO is not set # CONFIG_TOUCHSCREEN_MK712 is not set # CONFIG_TOUCHSCREEN_PENMOUNT is not set # CONFIG_TOUCHSCREEN_EDT_FT5X06 is not set # CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set # CONFIG_TOUCHSCREEN_TOUCHWIN is not set # CONFIG_TOUCHSCREEN_PIXCIR is not set # CONFIG_TOUCHSCREEN_WDT87XX_I2C is not set CONFIG_TOUCHSCREEN_USB_COMPOSITE=m CONFIG_TOUCHSCREEN_USB_EGALAX=y CONFIG_TOUCHSCREEN_USB_PANJIT=y CONFIG_TOUCHSCREEN_USB_3M=y CONFIG_TOUCHSCREEN_USB_ITM=y CONFIG_TOUCHSCREEN_USB_ETURBO=y CONFIG_TOUCHSCREEN_USB_GUNZE=y CONFIG_TOUCHSCREEN_USB_DMC_TSC10=y CONFIG_TOUCHSCREEN_USB_IRTOUCH=y CONFIG_TOUCHSCREEN_USB_IDEALTEK=y CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH=y CONFIG_TOUCHSCREEN_USB_GOTOP=y CONFIG_TOUCHSCREEN_USB_JASTEC=y CONFIG_TOUCHSCREEN_USB_ELO=y CONFIG_TOUCHSCREEN_USB_E2I=y CONFIG_TOUCHSCREEN_USB_ZYTRONIC=y CONFIG_TOUCHSCREEN_USB_ETT_TC45USB=y CONFIG_TOUCHSCREEN_USB_NEXIO=y CONFIG_TOUCHSCREEN_USB_EASYTOUCH=y # CONFIG_TOUCHSCREEN_TOUCHIT213 is not set # CONFIG_TOUCHSCREEN_TSC_SERIO is not set # CONFIG_TOUCHSCREEN_TSC2004 is not set # CONFIG_TOUCHSCREEN_TSC2005 is not set # CONFIG_TOUCHSCREEN_TSC2007 is not set # CONFIG_TOUCHSCREEN_RM_TS is not set # CONFIG_TOUCHSCREEN_SILEAD is not set # CONFIG_TOUCHSCREEN_SIS_I2C is not set # CONFIG_TOUCHSCREEN_ST1232 is not set # CONFIG_TOUCHSCREEN_STMFTS is not set # CONFIG_TOUCHSCREEN_SUR40 is not set # CONFIG_TOUCHSCREEN_SURFACE3_SPI is not set # CONFIG_TOUCHSCREEN_SX8654 is not set # CONFIG_TOUCHSCREEN_TPS6507X is not set # CONFIG_TOUCHSCREEN_ZET6223 is not set # CONFIG_TOUCHSCREEN_ZFORCE is not set # CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set # CONFIG_TOUCHSCREEN_IQS5XX is not set # CONFIG_TOUCHSCREEN_ZINITIX is not set CONFIG_INPUT_MISC=y # CONFIG_INPUT_AD714X is not set # CONFIG_INPUT_ATMEL_CAPTOUCH is not set # CONFIG_INPUT_BMA150 is not set # CONFIG_INPUT_E3X0_BUTTON is not set # CONFIG_INPUT_PM8941_PWRKEY is not set # CONFIG_INPUT_PM8XXX_VIBRATOR is not set # CONFIG_INPUT_MMA8450 is not set # CONFIG_INPUT_GPIO_BEEPER is not set # CONFIG_INPUT_GPIO_DECODER is not set # CONFIG_INPUT_GPIO_VIBRA is not set # CONFIG_INPUT_ATI_REMOTE2 is not set # CONFIG_INPUT_KEYSPAN_REMOTE is not set # CONFIG_INPUT_KXTJ9 is not set # CONFIG_INPUT_POWERMATE is not set # CONFIG_INPUT_YEALINK is not set # CONFIG_INPUT_CM109 is not set # CONFIG_INPUT_REGULATOR_HAPTIC is not set CONFIG_INPUT_UINPUT=m # CONFIG_INPUT_PCF8574 is not set # CONFIG_INPUT_PWM_BEEPER is not set # CONFIG_INPUT_PWM_VIBRA is not set # CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set # CONFIG_INPUT_DA7280_HAPTICS is not set # CONFIG_INPUT_ADXL34X is not set # CONFIG_INPUT_IMS_PCU is not set # CONFIG_INPUT_IQS269A is not set # CONFIG_INPUT_IQS626A is not set # CONFIG_INPUT_CMA3000 is not set # CONFIG_INPUT_DRV260X_HAPTICS is not set # CONFIG_INPUT_DRV2665_HAPTICS is not set # CONFIG_INPUT_DRV2667_HAPTICS is not set CONFIG_RMI4_CORE=m # CONFIG_RMI4_I2C is not set # CONFIG_RMI4_SPI is not set # CONFIG_RMI4_SMB is not set CONFIG_RMI4_F03=y CONFIG_RMI4_F03_SERIO=m CONFIG_RMI4_2D_SENSOR=y CONFIG_RMI4_F11=y CONFIG_RMI4_F12=y CONFIG_RMI4_F30=y # CONFIG_RMI4_F34 is not set # CONFIG_RMI4_F3A is not set # CONFIG_RMI4_F54 is not set # CONFIG_RMI4_F55 is not set # # Hardware I/O ports # CONFIG_SERIO=m CONFIG_SERIO_SERPORT=m # CONFIG_SERIO_PARKBD is not set # CONFIG_SERIO_AMBAKMI is not set # CONFIG_SERIO_LIBPS2 is not set # CONFIG_SERIO_RAW is not set # CONFIG_SERIO_ALTERA_PS2 is not set # CONFIG_SERIO_PS2MULT is not set # CONFIG_SERIO_ARC_PS2 is not set # CONFIG_SERIO_APBPS2 is not set # CONFIG_SERIO_GPIO_PS2 is not set # CONFIG_USERIO is not set # CONFIG_GAMEPORT is not set # end of Hardware I/O ports # end of Input device support # # Character devices # CONFIG_TTY=y # CONFIG_VT is not set CONFIG_UNIX98_PTYS=y # CONFIG_LEGACY_PTYS is not set CONFIG_LDISC_AUTOLOAD=y # # Serial drivers # CONFIG_SERIAL_EARLYCON=y CONFIG_SERIAL_8250=y # CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set CONFIG_SERIAL_8250_16550A_VARIANTS=y # CONFIG_SERIAL_8250_FINTEK is not set CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_8250_DMA=y CONFIG_SERIAL_8250_NR_UARTS=4 CONFIG_SERIAL_8250_RUNTIME_UARTS=4 # CONFIG_SERIAL_8250_EXTENDED is not set # CONFIG_SERIAL_8250_ASPEED_VUART is not set CONFIG_SERIAL_8250_DWLIB=y CONFIG_SERIAL_8250_FSL=y CONFIG_SERIAL_8250_DW=y # CONFIG_SERIAL_8250_RT288X is not set CONFIG_SERIAL_OF_PLATFORM=y # # Non-8250 serial port support # # CONFIG_SERIAL_AMBA_PL010 is not set # CONFIG_SERIAL_AMBA_PL011 is not set # CONFIG_SERIAL_EARLYCON_ARM_SEMIHOST is not set # CONFIG_SERIAL_MAX3100 is not set # CONFIG_SERIAL_MAX310X is not set # CONFIG_SERIAL_UARTLITE is not set CONFIG_SERIAL_CORE=y CONFIG_SERIAL_CORE_CONSOLE=y # CONFIG_SERIAL_MSM is not set CONFIG_SERIAL_QCOM_GENI=y CONFIG_SERIAL_QCOM_GENI_CONSOLE=y # CONFIG_SERIAL_SIFIVE is not set # CONFIG_SERIAL_SCCNXP is not set # CONFIG_SERIAL_SC16IS7XX is not set # CONFIG_SERIAL_BCM63XX is not set # CONFIG_SERIAL_ALTERA_JTAGUART is not set # CONFIG_SERIAL_ALTERA_UART is not set # CONFIG_SERIAL_XILINX_PS_UART is not set # CONFIG_SERIAL_ARC is not set # CONFIG_SERIAL_FSL_LPUART is not set # CONFIG_SERIAL_FSL_LINFLEXUART is not set # CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set # CONFIG_SERIAL_SPRD is not set # end of Serial drivers CONFIG_SERIAL_MCTRL_GPIO=y # CONFIG_SERIAL_NONSTANDARD is not set # CONFIG_N_GSM is not set # CONFIG_NULL_TTY is not set # CONFIG_HVC_DCC is not set CONFIG_SERIAL_DEV_BUS=y CONFIG_SERIAL_DEV_CTRL_TTYPORT=y # CONFIG_TTY_PRINTK is not set # CONFIG_PRINTER is not set # CONFIG_PPDEV is not set # CONFIG_VIRTIO_CONSOLE is not set # CONFIG_IPMI_HANDLER is not set CONFIG_HW_RANDOM=y # CONFIG_HW_RANDOM_TIMERIOMEM is not set # CONFIG_HW_RANDOM_BA431 is not set # CONFIG_HW_RANDOM_VIRTIO is not set # CONFIG_HW_RANDOM_CCTRNG is not set # CONFIG_HW_RANDOM_XIPHERA is not set CONFIG_DEVMEM=y CONFIG_TCG_TPM=y CONFIG_HW_RANDOM_TPM=y CONFIG_TCG_TIS_CORE=y # CONFIG_TCG_TIS is not set CONFIG_TCG_TIS_SPI=y CONFIG_TCG_TIS_SPI_CR50=y # CONFIG_TCG_TIS_I2C_CR50 is not set # CONFIG_TCG_TIS_I2C_ATMEL is not set CONFIG_TCG_TIS_I2C_INFINEON=y # CONFIG_TCG_TIS_I2C_NUVOTON is not set # CONFIG_TCG_VTPM_PROXY is not set # CONFIG_TCG_TIS_ST33ZP24_I2C is not set # CONFIG_TCG_TIS_ST33ZP24_SPI is not set # CONFIG_XILLYBUS is not set # CONFIG_XILLYUSB is not set # end of Character devices # CONFIG_RANDOM_TRUST_CPU is not set CONFIG_RANDOM_TRUST_BOOTLOADER=y # # I2C support # CONFIG_I2C=y CONFIG_I2C_BOARDINFO=y CONFIG_I2C_COMPAT=y CONFIG_I2C_CHARDEV=y CONFIG_I2C_MUX=y # # Multiplexer I2C Chip support # # CONFIG_I2C_ARB_GPIO_CHALLENGE is not set # CONFIG_I2C_MUX_GPIO is not set # CONFIG_I2C_MUX_GPMUX is not set # CONFIG_I2C_MUX_LTC4306 is not set # CONFIG_I2C_MUX_PCA9541 is not set # CONFIG_I2C_MUX_PCA954x is not set # CONFIG_I2C_MUX_PINCTRL is not set # CONFIG_I2C_MUX_REG is not set # CONFIG_I2C_DEMUX_PINCTRL is not set # CONFIG_I2C_MUX_MLXCPLD is not set # end of Multiplexer I2C Chip support CONFIG_I2C_HELPER_AUTO=y CONFIG_I2C_ALGOBIT=y # # I2C Hardware Bus support # # # I2C system bus drivers (mostly embedded / system-on-chip) # # CONFIG_I2C_CADENCE is not set # CONFIG_I2C_CBUS_GPIO is not set # CONFIG_I2C_DESIGNWARE_PLATFORM is not set # CONFIG_I2C_EMEV2 is not set # CONFIG_I2C_GPIO is not set # CONFIG_I2C_NOMADIK is not set # CONFIG_I2C_OCORES is not set # CONFIG_I2C_PCA_PLATFORM is not set # CONFIG_I2C_QCOM_CCI is not set CONFIG_I2C_QCOM_GENI=y # CONFIG_I2C_QUP is not set # CONFIG_I2C_RK3X is not set # CONFIG_I2C_SIMTEC is not set # CONFIG_I2C_XILINX is not set # # External I2C/SMBus adapter drivers # # CONFIG_I2C_DIOLAN_U2C is not set # CONFIG_I2C_CP2615 is not set # CONFIG_I2C_PARPORT is not set # CONFIG_I2C_ROBOTFUZZ_OSIF is not set # CONFIG_I2C_TAOS_EVM is not set # CONFIG_I2C_TINY_USB is not set # # Other I2C/SMBus bus drivers # CONFIG_I2C_CROS_EC_TUNNEL=y # end of I2C Hardware Bus support CONFIG_I2C_STUB=m # CONFIG_I2C_SLAVE is not set # CONFIG_I2C_DEBUG_CORE is not set # CONFIG_I2C_DEBUG_ALGO is not set # CONFIG_I2C_DEBUG_BUS is not set # end of I2C support # CONFIG_I3C is not set CONFIG_SPI=y # CONFIG_SPI_DEBUG is not set CONFIG_SPI_MASTER=y CONFIG_SPI_MEM=y # # SPI Master Controller Drivers # # CONFIG_SPI_ALTERA is not set # CONFIG_SPI_AXI_SPI_ENGINE is not set # CONFIG_SPI_BITBANG is not set # CONFIG_SPI_BUTTERFLY is not set # CONFIG_SPI_CADENCE is not set # CONFIG_SPI_CADENCE_QUADSPI is not set # CONFIG_SPI_DESIGNWARE is not set # CONFIG_SPI_NXP_FLEXSPI is not set # CONFIG_SPI_GPIO is not set # CONFIG_SPI_LM70_LLP is not set # CONFIG_SPI_FSL_SPI is not set # CONFIG_SPI_OC_TINY is not set # CONFIG_SPI_PL022 is not set # CONFIG_SPI_ROCKCHIP is not set CONFIG_SPI_QCOM_QSPI=y # CONFIG_SPI_QUP is not set CONFIG_SPI_QCOM_GENI=y # CONFIG_SPI_SC18IS602 is not set # CONFIG_SPI_SIFIVE is not set # CONFIG_SPI_MXIC is not set # CONFIG_SPI_XCOMM is not set # CONFIG_SPI_XILINX is not set # CONFIG_SPI_ZYNQMP_GQSPI is not set # CONFIG_SPI_AMD is not set # # SPI Multiplexer support # # CONFIG_SPI_MUX is not set # # SPI Protocol Masters # CONFIG_SPI_SPIDEV=y # CONFIG_SPI_LOOPBACK_TEST is not set # CONFIG_SPI_TLE62X0 is not set # CONFIG_SPI_SLAVE is not set CONFIG_SPMI=y # CONFIG_SPMI_HISI3670 is not set CONFIG_SPMI_MSM_PMIC_ARB=y # CONFIG_HSI is not set CONFIG_PPS=m # CONFIG_PPS_DEBUG is not set # # PPS clients support # # CONFIG_PPS_CLIENT_KTIMER is not set # CONFIG_PPS_CLIENT_LDISC is not set # CONFIG_PPS_CLIENT_PARPORT is not set # CONFIG_PPS_CLIENT_GPIO is not set # # PPS generators support # # # PTP clock support # CONFIG_PTP_1588_CLOCK=m # # Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. # CONFIG_PTP_1588_CLOCK_KVM=m # CONFIG_PTP_1588_CLOCK_IDT82P33 is not set # CONFIG_PTP_1588_CLOCK_IDTCM is not set # end of PTP clock support CONFIG_PINCTRL=y CONFIG_PINMUX=y CONFIG_PINCONF=y CONFIG_GENERIC_PINCONF=y # CONFIG_DEBUG_PINCTRL is not set # CONFIG_PINCTRL_AS3722 is not set # CONFIG_PINCTRL_MCP23S08 is not set # CONFIG_PINCTRL_SINGLE is not set # CONFIG_PINCTRL_SX150X is not set # CONFIG_PINCTRL_STMFX is not set # CONFIG_PINCTRL_OCELOT is not set # CONFIG_PINCTRL_MICROCHIP_SGPIO is not set CONFIG_PINCTRL_MSM=y # CONFIG_PINCTRL_APQ8064 is not set # CONFIG_PINCTRL_APQ8084 is not set # CONFIG_PINCTRL_IPQ4019 is not set # CONFIG_PINCTRL_IPQ8064 is not set # CONFIG_PINCTRL_IPQ8074 is not set # CONFIG_PINCTRL_IPQ6018 is not set # CONFIG_PINCTRL_MSM8226 is not set # CONFIG_PINCTRL_MSM8660 is not set # CONFIG_PINCTRL_MSM8960 is not set # CONFIG_PINCTRL_MDM9615 is not set # CONFIG_PINCTRL_MSM8X74 is not set # CONFIG_PINCTRL_MSM8916 is not set # CONFIG_PINCTRL_MSM8953 is not set # CONFIG_PINCTRL_MSM8976 is not set # CONFIG_PINCTRL_MSM8994 is not set # CONFIG_PINCTRL_MSM8996 is not set # CONFIG_PINCTRL_MSM8998 is not set # CONFIG_PINCTRL_QCS404 is not set CONFIG_PINCTRL_QCOM_SPMI_PMIC=y # CONFIG_PINCTRL_QCOM_SSBI_PMIC is not set CONFIG_PINCTRL_SC7180=y # CONFIG_PINCTRL_SC7280 is not set # CONFIG_PINCTRL_SC8180X is not set # CONFIG_PINCTRL_SDM660 is not set CONFIG_PINCTRL_SDM845=y # CONFIG_PINCTRL_SDX55 is not set # CONFIG_PINCTRL_SM6125 is not set # CONFIG_PINCTRL_SM8150 is not set # CONFIG_PINCTRL_SM8250 is not set # CONFIG_PINCTRL_SM8350 is not set # CONFIG_PINCTRL_LPASS_LPI is not set # # Renesas pinctrl drivers # # end of Renesas pinctrl drivers CONFIG_GPIOLIB=y CONFIG_GPIOLIB_FASTPATH_LIMIT=512 CONFIG_OF_GPIO=y CONFIG_GPIOLIB_IRQCHIP=y CONFIG_DEBUG_GPIO=y CONFIG_GPIO_SYSFS=y CONFIG_GPIO_CDEV=y CONFIG_GPIO_CDEV_V1=y # # Memory mapped GPIO drivers # # CONFIG_GPIO_74XX_MMIO is not set # CONFIG_GPIO_ALTERA is not set # CONFIG_GPIO_CADENCE is not set # CONFIG_GPIO_DWAPB is not set # CONFIG_GPIO_FTGPIO010 is not set # CONFIG_GPIO_GENERIC_PLATFORM is not set # CONFIG_GPIO_GRGPIO is not set # CONFIG_GPIO_HLWD is not set # CONFIG_GPIO_LOGICVC is not set # CONFIG_GPIO_MB86S7X is not set # CONFIG_GPIO_PL061 is not set # CONFIG_GPIO_SAMA5D2_PIOBU is not set # CONFIG_GPIO_SIFIVE is not set # CONFIG_GPIO_SYSCON is not set # CONFIG_GPIO_XGENE is not set # CONFIG_GPIO_XILINX is not set # CONFIG_GPIO_AMD_FCH is not set # end of Memory mapped GPIO drivers # # I2C GPIO expanders # # CONFIG_GPIO_ADP5588 is not set # CONFIG_GPIO_ADNP is not set # CONFIG_GPIO_GW_PLD is not set # CONFIG_GPIO_MAX7300 is not set # CONFIG_GPIO_MAX732X is not set # CONFIG_GPIO_PCA953X is not set # CONFIG_GPIO_PCA9570 is not set # CONFIG_GPIO_PCF857X is not set # CONFIG_GPIO_TPIC2810 is not set # end of I2C GPIO expanders # # MFD GPIO expanders # # CONFIG_GPIO_TPS6586X is not set # end of MFD GPIO expanders # # SPI GPIO expanders # # CONFIG_GPIO_74X164 is not set # CONFIG_GPIO_MAX3191X is not set # CONFIG_GPIO_MAX7301 is not set # CONFIG_GPIO_MC33880 is not set # CONFIG_GPIO_PISOSR is not set # CONFIG_GPIO_XRA1403 is not set # end of SPI GPIO expanders # # USB GPIO expanders # # end of USB GPIO expanders # # Virtual GPIO drivers # # CONFIG_GPIO_AGGREGATOR is not set # CONFIG_GPIO_MOCKUP is not set # end of Virtual GPIO drivers # CONFIG_W1 is not set CONFIG_POWER_RESET=y CONFIG_POWER_RESET_AS3722=y # CONFIG_POWER_RESET_BRCMSTB is not set # CONFIG_POWER_RESET_GPIO is not set CONFIG_POWER_RESET_GPIO_RESTART=y # CONFIG_POWER_RESET_MSM is not set # CONFIG_POWER_RESET_QCOM_PON is not set # CONFIG_POWER_RESET_LTC2952 is not set # CONFIG_POWER_RESET_MT6323 is not set # CONFIG_POWER_RESET_REGULATOR is not set # CONFIG_POWER_RESET_RESTART is not set # CONFIG_POWER_RESET_XGENE is not set # CONFIG_POWER_RESET_SYSCON is not set # CONFIG_POWER_RESET_SYSCON_POWEROFF is not set # CONFIG_SYSCON_REBOOT_MODE is not set # CONFIG_NVMEM_REBOOT_MODE is not set CONFIG_POWER_SUPPLY=y # CONFIG_POWER_SUPPLY_DEBUG is not set CONFIG_POWER_SUPPLY_HWMON=y # CONFIG_PDA_POWER is not set # CONFIG_GENERIC_ADC_BATTERY is not set # CONFIG_TEST_POWER is not set # CONFIG_CHARGER_ADP5061 is not set # CONFIG_BATTERY_CW2015 is not set # CONFIG_BATTERY_DS2780 is not set # CONFIG_BATTERY_DS2781 is not set # CONFIG_BATTERY_DS2782 is not set CONFIG_BATTERY_SBS=y # CONFIG_CHARGER_SBS is not set # CONFIG_MANAGER_SBS is not set # CONFIG_BATTERY_BQ27XXX is not set # CONFIG_BATTERY_MAX17040 is not set # CONFIG_BATTERY_MAX17042 is not set # CONFIG_CHARGER_MAX8903 is not set # CONFIG_CHARGER_LP8727 is not set CONFIG_CHARGER_GPIO=y # CONFIG_CHARGER_MANAGER is not set # CONFIG_CHARGER_LT3651 is not set # CONFIG_CHARGER_LTC4162L is not set # CONFIG_CHARGER_DETECTOR_MAX14656 is not set # CONFIG_CHARGER_QCOM_SMBB is not set # CONFIG_CHARGER_BQ2415X is not set # CONFIG_CHARGER_BQ24190 is not set # CONFIG_CHARGER_BQ24257 is not set # CONFIG_CHARGER_BQ24735 is not set # CONFIG_CHARGER_BQ2515X is not set # CONFIG_CHARGER_BQ25890 is not set # CONFIG_CHARGER_BQ25980 is not set # CONFIG_CHARGER_BQ256XX is not set # CONFIG_CHARGER_SMB347 is not set # CONFIG_CHARGER_TPS65090 is not set # CONFIG_BATTERY_GAUGE_LTC2941 is not set # CONFIG_BATTERY_GOLDFISH is not set # CONFIG_BATTERY_RT5033 is not set # CONFIG_CHARGER_RT9455 is not set CONFIG_CHARGER_CROS_USBPD=y # CONFIG_CHARGER_UCS1002 is not set # CONFIG_CHARGER_BD99954 is not set CONFIG_HWMON=y # CONFIG_HWMON_DEBUG_CHIP is not set # # Native drivers # # CONFIG_SENSORS_AD7314 is not set # CONFIG_SENSORS_AD7414 is not set # CONFIG_SENSORS_AD7418 is not set # CONFIG_SENSORS_ADM1021 is not set # CONFIG_SENSORS_ADM1025 is not set # CONFIG_SENSORS_ADM1026 is not set # CONFIG_SENSORS_ADM1029 is not set # CONFIG_SENSORS_ADM1031 is not set # CONFIG_SENSORS_ADM1177 is not set # CONFIG_SENSORS_ADM9240 is not set # CONFIG_SENSORS_ADT7310 is not set # CONFIG_SENSORS_ADT7410 is not set # CONFIG_SENSORS_ADT7411 is not set # CONFIG_SENSORS_ADT7462 is not set # CONFIG_SENSORS_ADT7470 is not set # CONFIG_SENSORS_ADT7475 is not set # CONFIG_SENSORS_AHT10 is not set # CONFIG_SENSORS_AS370 is not set # CONFIG_SENSORS_ASC7621 is not set # CONFIG_SENSORS_AXI_FAN_CONTROL is not set # CONFIG_SENSORS_ASPEED is not set # CONFIG_SENSORS_ATXP1 is not set # CONFIG_SENSORS_CORSAIR_CPRO is not set # CONFIG_SENSORS_CORSAIR_PSU is not set # CONFIG_SENSORS_DS620 is not set # CONFIG_SENSORS_DS1621 is not set # CONFIG_SENSORS_F71805F is not set # CONFIG_SENSORS_F71882FG is not set # CONFIG_SENSORS_F75375S is not set # CONFIG_SENSORS_FTSTEUTATES is not set # CONFIG_SENSORS_GL518SM is not set # CONFIG_SENSORS_GL520SM is not set # CONFIG_SENSORS_G760A is not set # CONFIG_SENSORS_G762 is not set # CONFIG_SENSORS_GPIO_FAN is not set # CONFIG_SENSORS_HIH6130 is not set # CONFIG_SENSORS_IIO_HWMON is not set # CONFIG_SENSORS_IT87 is not set # CONFIG_SENSORS_JC42 is not set # CONFIG_SENSORS_POWR1220 is not set # CONFIG_SENSORS_LINEAGE is not set # CONFIG_SENSORS_LTC2945 is not set # CONFIG_SENSORS_LTC2947_I2C is not set # CONFIG_SENSORS_LTC2947_SPI is not set # CONFIG_SENSORS_LTC2990 is not set # CONFIG_SENSORS_LTC2992 is not set # CONFIG_SENSORS_LTC4151 is not set # CONFIG_SENSORS_LTC4215 is not set # CONFIG_SENSORS_LTC4222 is not set # CONFIG_SENSORS_LTC4245 is not set # CONFIG_SENSORS_LTC4260 is not set # CONFIG_SENSORS_LTC4261 is not set # CONFIG_SENSORS_MAX1111 is not set # CONFIG_SENSORS_MAX127 is not set # CONFIG_SENSORS_MAX16065 is not set # CONFIG_SENSORS_MAX1619 is not set # CONFIG_SENSORS_MAX1668 is not set # CONFIG_SENSORS_MAX197 is not set # CONFIG_SENSORS_MAX31722 is not set # CONFIG_SENSORS_MAX31730 is not set # CONFIG_SENSORS_MAX6621 is not set # CONFIG_SENSORS_MAX6639 is not set # CONFIG_SENSORS_MAX6642 is not set # CONFIG_SENSORS_MAX6650 is not set # CONFIG_SENSORS_MAX6697 is not set # CONFIG_SENSORS_MAX31790 is not set # CONFIG_SENSORS_MCP3021 is not set # CONFIG_SENSORS_TC654 is not set # CONFIG_SENSORS_TPS23861 is not set # CONFIG_SENSORS_MR75203 is not set # CONFIG_SENSORS_ADCXX is not set # CONFIG_SENSORS_LM63 is not set # CONFIG_SENSORS_LM70 is not set # CONFIG_SENSORS_LM73 is not set # CONFIG_SENSORS_LM75 is not set # CONFIG_SENSORS_LM77 is not set # CONFIG_SENSORS_LM78 is not set # CONFIG_SENSORS_LM80 is not set # CONFIG_SENSORS_LM83 is not set # CONFIG_SENSORS_LM85 is not set # CONFIG_SENSORS_LM87 is not set # CONFIG_SENSORS_LM90 is not set # CONFIG_SENSORS_LM92 is not set # CONFIG_SENSORS_LM93 is not set # CONFIG_SENSORS_LM95234 is not set # CONFIG_SENSORS_LM95241 is not set # CONFIG_SENSORS_LM95245 is not set # CONFIG_SENSORS_PC87360 is not set # CONFIG_SENSORS_PC87427 is not set # CONFIG_SENSORS_NTC_THERMISTOR is not set # CONFIG_SENSORS_NCT6683 is not set # CONFIG_SENSORS_NCT6775 is not set # CONFIG_SENSORS_NCT7802 is not set # CONFIG_SENSORS_NCT7904 is not set # CONFIG_SENSORS_NPCM7XX is not set # CONFIG_SENSORS_NZXT_KRAKEN2 is not set # CONFIG_SENSORS_OCC_P8_I2C is not set # CONFIG_SENSORS_PCF8591 is not set # CONFIG_PMBUS is not set # CONFIG_SENSORS_PWM_FAN is not set # CONFIG_SENSORS_SBTSI is not set # CONFIG_SENSORS_SHT15 is not set # CONFIG_SENSORS_SHT21 is not set # CONFIG_SENSORS_SHT3x is not set # CONFIG_SENSORS_SHT4x is not set # CONFIG_SENSORS_SHTC1 is not set # CONFIG_SENSORS_DME1737 is not set # CONFIG_SENSORS_EMC1403 is not set # CONFIG_SENSORS_EMC2103 is not set # CONFIG_SENSORS_EMC6W201 is not set # CONFIG_SENSORS_SMSC47M1 is not set # CONFIG_SENSORS_SMSC47M192 is not set # CONFIG_SENSORS_SMSC47B397 is not set # CONFIG_SENSORS_SCH5627 is not set # CONFIG_SENSORS_SCH5636 is not set # CONFIG_SENSORS_STTS751 is not set # CONFIG_SENSORS_SMM665 is not set # CONFIG_SENSORS_ADC128D818 is not set # CONFIG_SENSORS_ADS7828 is not set # CONFIG_SENSORS_ADS7871 is not set # CONFIG_SENSORS_AMC6821 is not set # CONFIG_SENSORS_INA209 is not set # CONFIG_SENSORS_INA2XX is not set # CONFIG_SENSORS_INA3221 is not set # CONFIG_SENSORS_TC74 is not set # CONFIG_SENSORS_THMC50 is not set # CONFIG_SENSORS_TMP102 is not set # CONFIG_SENSORS_TMP103 is not set # CONFIG_SENSORS_TMP108 is not set # CONFIG_SENSORS_TMP401 is not set # CONFIG_SENSORS_TMP421 is not set # CONFIG_SENSORS_TMP513 is not set # CONFIG_SENSORS_VT1211 is not set # CONFIG_SENSORS_W83773G is not set # CONFIG_SENSORS_W83781D is not set # CONFIG_SENSORS_W83791D is not set # CONFIG_SENSORS_W83792D is not set # CONFIG_SENSORS_W83793 is not set # CONFIG_SENSORS_W83795 is not set # CONFIG_SENSORS_W83L785TS is not set # CONFIG_SENSORS_W83L786NG is not set # CONFIG_SENSORS_W83627HF is not set # CONFIG_SENSORS_W83627EHF is not set CONFIG_THERMAL=y # CONFIG_THERMAL_NETLINK is not set # CONFIG_THERMAL_STATISTICS is not set CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 CONFIG_THERMAL_HWMON=y CONFIG_THERMAL_OF=y CONFIG_THERMAL_WRITABLE_TRIPS=y CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y # CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set # CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set CONFIG_THERMAL_GOV_FAIR_SHARE=y CONFIG_THERMAL_GOV_STEP_WISE=y # CONFIG_THERMAL_GOV_BANG_BANG is not set CONFIG_THERMAL_GOV_USER_SPACE=y # CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set CONFIG_CPU_THERMAL=y CONFIG_CPU_FREQ_THERMAL=y CONFIG_DEVFREQ_THERMAL=y # CONFIG_THERMAL_EMULATION is not set # CONFIG_THERMAL_MMIO is not set # CONFIG_GENERIC_ADC_THERMAL is not set # # Qualcomm thermal drivers # CONFIG_QCOM_TSENS=y # CONFIG_QCOM_SPMI_ADC_TM5 is not set CONFIG_QCOM_SPMI_TEMP_ALARM=y # end of Qualcomm thermal drivers CONFIG_WATCHDOG=y CONFIG_WATCHDOG_CORE=y # CONFIG_WATCHDOG_NOWAYOUT is not set CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y CONFIG_WATCHDOG_OPEN_TIMEOUT=0 # CONFIG_WATCHDOG_SYSFS is not set # CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT is not set # # Watchdog Pretimeout Governors # # CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set # # Watchdog Device Drivers # CONFIG_SOFT_WATCHDOG=m # CONFIG_GPIO_WATCHDOG is not set # CONFIG_XILINX_WATCHDOG is not set # CONFIG_ZIIRAVE_WATCHDOG is not set # CONFIG_ARM_SP805_WATCHDOG is not set # CONFIG_ARM_SBSA_WATCHDOG is not set # CONFIG_CADENCE_WATCHDOG is not set # CONFIG_DW_WATCHDOG is not set # CONFIG_MAX63XX_WATCHDOG is not set CONFIG_QCOM_WDT=y # CONFIG_ARM_SMC_WATCHDOG is not set # CONFIG_PM8916_WATCHDOG is not set # CONFIG_MEN_A21_WDT is not set # # USB-based Watchdog Cards # # CONFIG_USBPCWATCHDOG is not set CONFIG_SSB_POSSIBLE=y # CONFIG_SSB is not set CONFIG_BCMA_POSSIBLE=y # CONFIG_BCMA is not set # # Multifunction device drivers # CONFIG_MFD_CORE=y # CONFIG_MFD_ACT8945A is not set # CONFIG_MFD_AS3711 is not set CONFIG_MFD_AS3722=y # CONFIG_PMIC_ADP5520 is not set # CONFIG_MFD_AAT2870_CORE is not set # CONFIG_MFD_ATMEL_FLEXCOM is not set # CONFIG_MFD_ATMEL_HLCDC is not set # CONFIG_MFD_BCM590XX is not set # CONFIG_MFD_BD9571MWV is not set # CONFIG_MFD_AXP20X_I2C is not set CONFIG_MFD_CROS_EC_DEV=y # CONFIG_MFD_MADERA is not set # CONFIG_PMIC_DA903X is not set # CONFIG_MFD_DA9052_SPI is not set # CONFIG_MFD_DA9052_I2C is not set # CONFIG_MFD_DA9055 is not set # CONFIG_MFD_DA9062 is not set # CONFIG_MFD_DA9063 is not set # CONFIG_MFD_DA9150 is not set # CONFIG_MFD_DLN2 is not set # CONFIG_MFD_GATEWORKS_GSC is not set # CONFIG_MFD_MC13XXX_SPI is not set # CONFIG_MFD_MC13XXX_I2C is not set # CONFIG_MFD_MP2629 is not set # CONFIG_MFD_HI6421_PMIC is not set # CONFIG_HTC_PASIC3 is not set # CONFIG_HTC_I2CPLD is not set # CONFIG_MFD_IQS62X is not set # CONFIG_MFD_KEMPLD is not set # CONFIG_MFD_88PM800 is not set # CONFIG_MFD_88PM805 is not set # CONFIG_MFD_88PM860X is not set # CONFIG_MFD_MAX14577 is not set # CONFIG_MFD_MAX77620 is not set # CONFIG_MFD_MAX77650 is not set # CONFIG_MFD_MAX77686 is not set # CONFIG_MFD_MAX77693 is not set # CONFIG_MFD_MAX77843 is not set # CONFIG_MFD_MAX8907 is not set # CONFIG_MFD_MAX8925 is not set # CONFIG_MFD_MAX8997 is not set # CONFIG_MFD_MAX8998 is not set # CONFIG_MFD_MT6360 is not set CONFIG_MFD_MT6397=y # CONFIG_MFD_MENF21BMC is not set # CONFIG_EZX_PCAP is not set # CONFIG_MFD_CPCAP is not set # CONFIG_MFD_VIPERBOARD is not set # CONFIG_MFD_NTXEC is not set # CONFIG_MFD_RETU is not set # CONFIG_MFD_PCF50633 is not set # CONFIG_MFD_QCOM_RPM is not set CONFIG_MFD_SPMI_PMIC=y # CONFIG_MFD_RT4831 is not set # CONFIG_MFD_RT5033 is not set # CONFIG_MFD_RC5T583 is not set # CONFIG_MFD_RK808 is not set # CONFIG_MFD_RN5T618 is not set # CONFIG_MFD_SEC_CORE is not set # CONFIG_MFD_SI476X_CORE is not set # CONFIG_MFD_SM501 is not set # CONFIG_MFD_SKY81452 is not set # CONFIG_MFD_STMPE is not set CONFIG_MFD_SYSCON=y # CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_LP8788 is not set # CONFIG_MFD_TI_LMU is not set # CONFIG_MFD_PALMAS is not set # CONFIG_TPS6105X is not set # CONFIG_TPS65010 is not set # CONFIG_TPS6507X is not set # CONFIG_MFD_TPS65086 is not set CONFIG_MFD_TPS65090=y # CONFIG_MFD_TPS65217 is not set # CONFIG_MFD_TI_LP873X is not set # CONFIG_MFD_TI_LP87565 is not set # CONFIG_MFD_TPS65218 is not set CONFIG_MFD_TPS6586X=y # CONFIG_MFD_TPS65910 is not set # CONFIG_MFD_TPS65912_I2C is not set # CONFIG_MFD_TPS65912_SPI is not set # CONFIG_MFD_TPS80031 is not set # CONFIG_TWL4030_CORE is not set # CONFIG_TWL6040_CORE is not set # CONFIG_MFD_WL1273_CORE is not set # CONFIG_MFD_LM3533 is not set # CONFIG_MFD_TC3589X is not set # CONFIG_MFD_TQMX86 is not set # CONFIG_MFD_LOCHNAGAR is not set # CONFIG_MFD_ARIZONA_I2C is not set # CONFIG_MFD_ARIZONA_SPI is not set # CONFIG_MFD_WM8400 is not set # CONFIG_MFD_WM831X_I2C is not set # CONFIG_MFD_WM831X_SPI is not set # CONFIG_MFD_WM8350_I2C is not set # CONFIG_MFD_WM8994 is not set # CONFIG_MFD_ROHM_BD718XX is not set # CONFIG_MFD_ROHM_BD70528 is not set # CONFIG_MFD_ROHM_BD71828 is not set # CONFIG_MFD_ROHM_BD957XMUF is not set # CONFIG_MFD_STPMIC1 is not set # CONFIG_MFD_STMFX is not set # CONFIG_MFD_ATC260X_I2C is not set # CONFIG_MFD_QCOM_PM8008 is not set # CONFIG_RAVE_SP_CORE is not set # CONFIG_MFD_INTEL_M10_BMC is not set # end of Multifunction device drivers CONFIG_REGULATOR=y # CONFIG_REGULATOR_DEBUG is not set CONFIG_REGULATOR_FIXED_VOLTAGE=y CONFIG_REGULATOR_VIRTUAL_CONSUMER=y CONFIG_REGULATOR_USERSPACE_CONSUMER=y # CONFIG_REGULATOR_88PG86X is not set # CONFIG_REGULATOR_ACT8865 is not set # CONFIG_REGULATOR_AD5398 is not set CONFIG_REGULATOR_AS3722=y # CONFIG_REGULATOR_CROS_EC is not set # CONFIG_REGULATOR_DA9121 is not set # CONFIG_REGULATOR_DA9210 is not set CONFIG_REGULATOR_DA9211=y # CONFIG_REGULATOR_FAN53555 is not set # CONFIG_REGULATOR_FAN53880 is not set CONFIG_REGULATOR_GPIO=y # CONFIG_REGULATOR_ISL9305 is not set # CONFIG_REGULATOR_ISL6271A is not set # CONFIG_REGULATOR_LP3971 is not set # CONFIG_REGULATOR_LP3972 is not set # CONFIG_REGULATOR_LP872X is not set # CONFIG_REGULATOR_LP8755 is not set # CONFIG_REGULATOR_LTC3589 is not set # CONFIG_REGULATOR_LTC3676 is not set # CONFIG_REGULATOR_MAX1586 is not set # CONFIG_REGULATOR_MAX8649 is not set # CONFIG_REGULATOR_MAX8660 is not set # CONFIG_REGULATOR_MAX8893 is not set # CONFIG_REGULATOR_MAX8952 is not set # CONFIG_REGULATOR_MAX8973 is not set # CONFIG_REGULATOR_MAX77826 is not set # CONFIG_REGULATOR_MCP16502 is not set # CONFIG_REGULATOR_MP5416 is not set # CONFIG_REGULATOR_MP8859 is not set # CONFIG_REGULATOR_MP886X is not set # CONFIG_REGULATOR_MPQ7920 is not set # CONFIG_REGULATOR_MT6311 is not set # CONFIG_REGULATOR_MT6315 is not set # CONFIG_REGULATOR_MT6323 is not set # CONFIG_REGULATOR_MT6358 is not set # CONFIG_REGULATOR_MT6359 is not set # CONFIG_REGULATOR_MT6397 is not set # CONFIG_REGULATOR_PCA9450 is not set # CONFIG_REGULATOR_PF8X00 is not set # CONFIG_REGULATOR_PFUZE100 is not set # CONFIG_REGULATOR_PV88060 is not set # CONFIG_REGULATOR_PV88080 is not set # CONFIG_REGULATOR_PV88090 is not set CONFIG_REGULATOR_PWM=y CONFIG_REGULATOR_QCOM_RPMH=y # CONFIG_REGULATOR_QCOM_SMD_RPM is not set # CONFIG_REGULATOR_QCOM_SPMI is not set # CONFIG_REGULATOR_QCOM_USB_VBUS is not set # CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY is not set # CONFIG_REGULATOR_RT4801 is not set # CONFIG_REGULATOR_RT6160 is not set # CONFIG_REGULATOR_RT6245 is not set # CONFIG_REGULATOR_RTMV20 is not set # CONFIG_REGULATOR_SLG51000 is not set # CONFIG_REGULATOR_SY8106A is not set # CONFIG_REGULATOR_SY8824X is not set # CONFIG_REGULATOR_SY8827N is not set # CONFIG_REGULATOR_TPS51632 is not set # CONFIG_REGULATOR_TPS62360 is not set # CONFIG_REGULATOR_TPS65023 is not set # CONFIG_REGULATOR_TPS6507X is not set # CONFIG_REGULATOR_TPS65090 is not set # CONFIG_REGULATOR_TPS65132 is not set # CONFIG_REGULATOR_TPS6524X is not set # CONFIG_REGULATOR_TPS6586X is not set # CONFIG_REGULATOR_VCTRL is not set # CONFIG_REGULATOR_VQMMC_IPQ4019 is not set # CONFIG_REGULATOR_QCOM_LABIBB is not set CONFIG_RC_CORE=y CONFIG_RC_MAP=y # CONFIG_LIRC is not set CONFIG_RC_DECODERS=y CONFIG_IR_NEC_DECODER=y CONFIG_IR_RC5_DECODER=y CONFIG_IR_RC6_DECODER=y CONFIG_IR_JVC_DECODER=y CONFIG_IR_SONY_DECODER=y CONFIG_IR_SANYO_DECODER=y CONFIG_IR_SHARP_DECODER=y CONFIG_IR_MCE_KBD_DECODER=y CONFIG_IR_XMP_DECODER=y # CONFIG_IR_IMON_DECODER is not set # CONFIG_IR_RCMM_DECODER is not set # CONFIG_RC_DEVICES is not set CONFIG_MEDIA_CEC_SUPPORT=y # CONFIG_CEC_CH7322 is not set # CONFIG_CEC_CROS_EC is not set # CONFIG_CEC_GPIO is not set # CONFIG_USB_PULSE8_CEC is not set # CONFIG_USB_RAINSHADOW_CEC is not set CONFIG_MEDIA_SUPPORT=y # CONFIG_MEDIA_SUPPORT_FILTER is not set CONFIG_MEDIA_SUBDRV_AUTOSELECT=y # # Media device types # CONFIG_MEDIA_CAMERA_SUPPORT=y CONFIG_MEDIA_ANALOG_TV_SUPPORT=y CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y CONFIG_MEDIA_RADIO_SUPPORT=y CONFIG_MEDIA_SDR_SUPPORT=y CONFIG_MEDIA_PLATFORM_SUPPORT=y CONFIG_MEDIA_TEST_SUPPORT=y # end of Media device types # # Media core support # CONFIG_VIDEO_DEV=y CONFIG_MEDIA_CONTROLLER=y CONFIG_DVB_CORE=y # end of Media core support # # Video4Linux options # CONFIG_VIDEO_V4L2=y CONFIG_VIDEO_V4L2_I2C=y # CONFIG_VIDEO_V4L2_SUBDEV_API is not set # CONFIG_VIDEO_ADV_DEBUG is not set # CONFIG_VIDEO_FIXED_MINOR_RANGES is not set CONFIG_V4L2_MEM2MEM_DEV=m # end of Video4Linux options # # Media controller options # # CONFIG_MEDIA_CONTROLLER_DVB is not set # end of Media controller options # # Digital TV options # # CONFIG_DVB_MMAP is not set CONFIG_DVB_NET=y CONFIG_DVB_MAX_ADAPTERS=16 CONFIG_DVB_DYNAMIC_MINORS=y # CONFIG_DVB_DEMUX_SECTION_LOSS_LOG is not set # CONFIG_DVB_ULE_DEBUG is not set # end of Digital TV options # # Media drivers # CONFIG_MEDIA_USB_SUPPORT=y # # Webcam devices # CONFIG_USB_VIDEO_CLASS=m # CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV is not set # CONFIG_USB_GSPCA is not set # CONFIG_USB_PWC is not set # CONFIG_VIDEO_CPIA2 is not set # CONFIG_USB_ZR364XX is not set # CONFIG_USB_STKWEBCAM is not set # CONFIG_USB_S2255 is not set # CONFIG_VIDEO_USBTV is not set # # Analog TV USB devices # # CONFIG_VIDEO_PVRUSB2 is not set # CONFIG_VIDEO_HDPVR is not set # CONFIG_VIDEO_STK1160_COMMON is not set # CONFIG_VIDEO_GO7007 is not set # # Analog/digital TV USB devices # # CONFIG_VIDEO_AU0828 is not set # CONFIG_VIDEO_CX231XX is not set # CONFIG_VIDEO_TM6000 is not set # # Digital TV USB devices # # CONFIG_DVB_USB is not set # CONFIG_DVB_USB_V2 is not set # CONFIG_SMS_USB_DRV is not set # CONFIG_DVB_B2C2_FLEXCOP_USB is not set # CONFIG_DVB_AS102 is not set # # Webcam, TV (analog/digital) USB devices # # CONFIG_VIDEO_EM28XX is not set # # Software defined radio USB devices # # CONFIG_USB_AIRSPY is not set # CONFIG_USB_HACKRF is not set # CONFIG_USB_MSI2500 is not set CONFIG_RADIO_ADAPTERS=y # CONFIG_RADIO_SI470X is not set # CONFIG_RADIO_SI4713 is not set # CONFIG_USB_MR800 is not set # CONFIG_USB_DSBR is not set # CONFIG_RADIO_SHARK is not set # CONFIG_RADIO_SHARK2 is not set # CONFIG_USB_KEENE is not set # CONFIG_USB_RAREMONO is not set # CONFIG_USB_MA901 is not set # CONFIG_RADIO_TEA5764 is not set # CONFIG_RADIO_SAA7706H is not set # CONFIG_RADIO_TEF6862 is not set # CONFIG_RADIO_WL1273 is not set CONFIG_VIDEOBUF2_CORE=m CONFIG_VIDEOBUF2_V4L2=m CONFIG_VIDEOBUF2_MEMOPS=m CONFIG_VIDEOBUF2_DMA_CONTIG=m CONFIG_VIDEOBUF2_VMALLOC=m # CONFIG_V4L_PLATFORM_DRIVERS is not set CONFIG_V4L_MEM2MEM_DRIVERS=y # CONFIG_VIDEO_MEM2MEM_DEINTERLACE is not set CONFIG_VIDEO_QCOM_VENUS=m # CONFIG_DVB_PLATFORM_DRIVERS is not set # CONFIG_SDR_PLATFORM_DRIVERS is not set # # MMC/SDIO DVB adapters # # CONFIG_SMS_SDIO_DRV is not set CONFIG_V4L_TEST_DRIVERS=y # CONFIG_VIDEO_VIMC is not set # CONFIG_VIDEO_VIVID is not set # CONFIG_VIDEO_VIM2M is not set # CONFIG_VIDEO_VICODEC is not set # CONFIG_DVB_TEST_DRIVERS is not set # end of Media drivers # # Media ancillary drivers # CONFIG_MEDIA_ATTACH=y # # IR I2C driver auto-selected by 'Autoselect ancillary drivers' # CONFIG_VIDEO_IR_I2C=y # # Audio decoders, processors and mixers # # CONFIG_VIDEO_TVAUDIO is not set # CONFIG_VIDEO_TDA7432 is not set # CONFIG_VIDEO_TDA9840 is not set # CONFIG_VIDEO_TDA1997X is not set # CONFIG_VIDEO_TEA6415C is not set # CONFIG_VIDEO_TEA6420 is not set # CONFIG_VIDEO_MSP3400 is not set # CONFIG_VIDEO_CS3308 is not set # CONFIG_VIDEO_CS5345 is not set # CONFIG_VIDEO_CS53L32A is not set # CONFIG_VIDEO_TLV320AIC23B is not set # CONFIG_VIDEO_UDA1342 is not set # CONFIG_VIDEO_WM8775 is not set # CONFIG_VIDEO_WM8739 is not set # CONFIG_VIDEO_VP27SMPX is not set # CONFIG_VIDEO_SONY_BTF_MPX is not set # end of Audio decoders, processors and mixers # # RDS decoders # # CONFIG_VIDEO_SAA6588 is not set # end of RDS decoders # # Video decoders # # CONFIG_VIDEO_ADV7180 is not set # CONFIG_VIDEO_ADV7183 is not set # CONFIG_VIDEO_ADV748X is not set # CONFIG_VIDEO_ADV7604 is not set # CONFIG_VIDEO_ADV7842 is not set # CONFIG_VIDEO_BT819 is not set # CONFIG_VIDEO_BT856 is not set # CONFIG_VIDEO_BT866 is not set # CONFIG_VIDEO_KS0127 is not set # CONFIG_VIDEO_ML86V7667 is not set # CONFIG_VIDEO_SAA7110 is not set # CONFIG_VIDEO_SAA711X is not set # CONFIG_VIDEO_TC358743 is not set # CONFIG_VIDEO_TVP514X is not set # CONFIG_VIDEO_TVP5150 is not set # CONFIG_VIDEO_TVP7002 is not set # CONFIG_VIDEO_TW2804 is not set # CONFIG_VIDEO_TW9903 is not set # CONFIG_VIDEO_TW9906 is not set # CONFIG_VIDEO_TW9910 is not set # CONFIG_VIDEO_VPX3220 is not set # CONFIG_VIDEO_MAX9286 is not set # # Video and audio decoders # # CONFIG_VIDEO_SAA717X is not set # CONFIG_VIDEO_CX25840 is not set # end of Video decoders # # Video encoders # # CONFIG_VIDEO_SAA7127 is not set # CONFIG_VIDEO_SAA7185 is not set # CONFIG_VIDEO_ADV7170 is not set # CONFIG_VIDEO_ADV7175 is not set # CONFIG_VIDEO_ADV7343 is not set # CONFIG_VIDEO_ADV7393 is not set # CONFIG_VIDEO_ADV7511 is not set # CONFIG_VIDEO_AD9389B is not set # CONFIG_VIDEO_AK881X is not set # CONFIG_VIDEO_THS8200 is not set # end of Video encoders # # Video improvement chips # # CONFIG_VIDEO_UPD64031A is not set # CONFIG_VIDEO_UPD64083 is not set # end of Video improvement chips # # Audio/Video compression chips # # CONFIG_VIDEO_SAA6752HS is not set # end of Audio/Video compression chips # # SDR tuner chips # # CONFIG_SDR_MAX2175 is not set # end of SDR tuner chips # # Miscellaneous helper chips # # CONFIG_VIDEO_THS7303 is not set # CONFIG_VIDEO_M52790 is not set # CONFIG_VIDEO_I2C is not set # CONFIG_VIDEO_ST_MIPID02 is not set # end of Miscellaneous helper chips # # Camera sensor devices # # CONFIG_VIDEO_HI556 is not set # CONFIG_VIDEO_IMX214 is not set # CONFIG_VIDEO_IMX219 is not set # CONFIG_VIDEO_IMX258 is not set # CONFIG_VIDEO_IMX274 is not set # CONFIG_VIDEO_IMX290 is not set # CONFIG_VIDEO_IMX319 is not set # CONFIG_VIDEO_IMX334 is not set # CONFIG_VIDEO_IMX355 is not set # CONFIG_VIDEO_OV02A10 is not set # CONFIG_VIDEO_OV2640 is not set # CONFIG_VIDEO_OV2659 is not set # CONFIG_VIDEO_OV2680 is not set # CONFIG_VIDEO_OV2685 is not set # CONFIG_VIDEO_OV5640 is not set # CONFIG_VIDEO_OV5645 is not set # CONFIG_VIDEO_OV5647 is not set # CONFIG_VIDEO_OV5648 is not set # CONFIG_VIDEO_OV6650 is not set # CONFIG_VIDEO_OV5670 is not set # CONFIG_VIDEO_OV5675 is not set # CONFIG_VIDEO_OV5695 is not set # CONFIG_VIDEO_OV7251 is not set # CONFIG_VIDEO_OV772X is not set # CONFIG_VIDEO_OV7640 is not set # CONFIG_VIDEO_OV7670 is not set # CONFIG_VIDEO_OV7740 is not set # CONFIG_VIDEO_OV8856 is not set # CONFIG_VIDEO_OV8865 is not set # CONFIG_VIDEO_OV9640 is not set # CONFIG_VIDEO_OV9650 is not set # CONFIG_VIDEO_OV13858 is not set # CONFIG_VIDEO_VS6624 is not set # CONFIG_VIDEO_MT9M001 is not set # CONFIG_VIDEO_MT9M032 is not set # CONFIG_VIDEO_MT9M111 is not set # CONFIG_VIDEO_MT9P031 is not set # CONFIG_VIDEO_MT9T001 is not set # CONFIG_VIDEO_MT9T112 is not set # CONFIG_VIDEO_MT9V011 is not set # CONFIG_VIDEO_MT9V032 is not set # CONFIG_VIDEO_MT9V111 is not set # CONFIG_VIDEO_SR030PC30 is not set # CONFIG_VIDEO_NOON010PC30 is not set # CONFIG_VIDEO_M5MOLS is not set # CONFIG_VIDEO_RDACM20 is not set # CONFIG_VIDEO_RDACM21 is not set # CONFIG_VIDEO_RJ54N1 is not set # CONFIG_VIDEO_S5K6AA is not set # CONFIG_VIDEO_S5K6A3 is not set # CONFIG_VIDEO_S5K4ECGX is not set # CONFIG_VIDEO_S5K5BAF is not set # CONFIG_VIDEO_CCS is not set # CONFIG_VIDEO_ET8EK8 is not set # CONFIG_VIDEO_S5C73M3 is not set # end of Camera sensor devices # # Lens drivers # # CONFIG_VIDEO_AD5820 is not set # CONFIG_VIDEO_AK7375 is not set # CONFIG_VIDEO_DW9714 is not set # CONFIG_VIDEO_DW9768 is not set # CONFIG_VIDEO_DW9807_VCM is not set # end of Lens drivers # # Flash devices # # CONFIG_VIDEO_ADP1653 is not set # CONFIG_VIDEO_LM3560 is not set # CONFIG_VIDEO_LM3646 is not set # end of Flash devices # # SPI helper chips # # CONFIG_VIDEO_GS1662 is not set # end of SPI helper chips # # Media SPI Adapters # # CONFIG_CXD2880_SPI_DRV is not set # end of Media SPI Adapters CONFIG_MEDIA_TUNER=y # # Customize TV tuners # CONFIG_MEDIA_TUNER_SIMPLE=y # CONFIG_MEDIA_TUNER_TDA18250 is not set CONFIG_MEDIA_TUNER_TDA8290=y CONFIG_MEDIA_TUNER_TDA827X=y CONFIG_MEDIA_TUNER_TDA18271=y CONFIG_MEDIA_TUNER_TDA9887=y CONFIG_MEDIA_TUNER_TEA5761=y CONFIG_MEDIA_TUNER_TEA5767=y # CONFIG_MEDIA_TUNER_MSI001 is not set CONFIG_MEDIA_TUNER_MT20XX=y # CONFIG_MEDIA_TUNER_MT2060 is not set # CONFIG_MEDIA_TUNER_MT2063 is not set # CONFIG_MEDIA_TUNER_MT2266 is not set # CONFIG_MEDIA_TUNER_MT2131 is not set # CONFIG_MEDIA_TUNER_QT1010 is not set CONFIG_MEDIA_TUNER_XC2028=y CONFIG_MEDIA_TUNER_XC5000=y CONFIG_MEDIA_TUNER_XC4000=y # CONFIG_MEDIA_TUNER_MXL5005S is not set # CONFIG_MEDIA_TUNER_MXL5007T is not set CONFIG_MEDIA_TUNER_MC44S803=y # CONFIG_MEDIA_TUNER_MAX2165 is not set # CONFIG_MEDIA_TUNER_TDA18218 is not set # CONFIG_MEDIA_TUNER_FC0011 is not set # CONFIG_MEDIA_TUNER_FC0012 is not set # CONFIG_MEDIA_TUNER_FC0013 is not set # CONFIG_MEDIA_TUNER_TDA18212 is not set # CONFIG_MEDIA_TUNER_E4000 is not set # CONFIG_MEDIA_TUNER_FC2580 is not set # CONFIG_MEDIA_TUNER_M88RS6000T is not set # CONFIG_MEDIA_TUNER_TUA9001 is not set # CONFIG_MEDIA_TUNER_SI2157 is not set # CONFIG_MEDIA_TUNER_IT913X is not set # CONFIG_MEDIA_TUNER_R820T is not set # CONFIG_MEDIA_TUNER_MXL301RF is not set # CONFIG_MEDIA_TUNER_QM1D1C0042 is not set # CONFIG_MEDIA_TUNER_QM1D1B0004 is not set # end of Customize TV tuners # # Customise DVB Frontends # # # Multistandard (satellite) frontends # # CONFIG_DVB_STB0899 is not set # CONFIG_DVB_STB6100 is not set # CONFIG_DVB_STV090x is not set # CONFIG_DVB_STV0910 is not set # CONFIG_DVB_STV6110x is not set # CONFIG_DVB_STV6111 is not set # CONFIG_DVB_MXL5XX is not set # CONFIG_DVB_M88DS3103 is not set # # Multistandard (cable + terrestrial) frontends # # CONFIG_DVB_DRXK is not set # CONFIG_DVB_TDA18271C2DD is not set # CONFIG_DVB_SI2165 is not set # CONFIG_DVB_MN88472 is not set # CONFIG_DVB_MN88473 is not set # # DVB-S (satellite) frontends # # CONFIG_DVB_CX24110 is not set # CONFIG_DVB_CX24123 is not set # CONFIG_DVB_MT312 is not set # CONFIG_DVB_ZL10036 is not set # CONFIG_DVB_ZL10039 is not set # CONFIG_DVB_S5H1420 is not set # CONFIG_DVB_STV0288 is not set # CONFIG_DVB_STB6000 is not set # CONFIG_DVB_STV0299 is not set # CONFIG_DVB_STV6110 is not set # CONFIG_DVB_STV0900 is not set # CONFIG_DVB_TDA8083 is not set # CONFIG_DVB_TDA10086 is not set # CONFIG_DVB_TDA8261 is not set # CONFIG_DVB_VES1X93 is not set # CONFIG_DVB_TUNER_ITD1000 is not set # CONFIG_DVB_TUNER_CX24113 is not set # CONFIG_DVB_TDA826X is not set # CONFIG_DVB_TUA6100 is not set # CONFIG_DVB_CX24116 is not set # CONFIG_DVB_CX24117 is not set # CONFIG_DVB_CX24120 is not set # CONFIG_DVB_SI21XX is not set # CONFIG_DVB_TS2020 is not set # CONFIG_DVB_DS3000 is not set # CONFIG_DVB_MB86A16 is not set # CONFIG_DVB_TDA10071 is not set # # DVB-T (terrestrial) frontends # # CONFIG_DVB_SP887X is not set # CONFIG_DVB_CX22700 is not set # CONFIG_DVB_CX22702 is not set # CONFIG_DVB_S5H1432 is not set # CONFIG_DVB_DRXD is not set # CONFIG_DVB_L64781 is not set # CONFIG_DVB_TDA1004X is not set # CONFIG_DVB_NXT6000 is not set # CONFIG_DVB_MT352 is not set # CONFIG_DVB_ZL10353 is not set # CONFIG_DVB_DIB3000MB is not set # CONFIG_DVB_DIB3000MC is not set # CONFIG_DVB_DIB7000M is not set # CONFIG_DVB_DIB7000P is not set # CONFIG_DVB_DIB9000 is not set # CONFIG_DVB_TDA10048 is not set # CONFIG_DVB_AF9013 is not set # CONFIG_DVB_EC100 is not set # CONFIG_DVB_STV0367 is not set # CONFIG_DVB_CXD2820R is not set # CONFIG_DVB_CXD2841ER is not set # CONFIG_DVB_RTL2830 is not set # CONFIG_DVB_RTL2832 is not set # CONFIG_DVB_RTL2832_SDR is not set # CONFIG_DVB_SI2168 is not set # CONFIG_DVB_ZD1301_DEMOD is not set # CONFIG_DVB_CXD2880 is not set # # DVB-C (cable) frontends # # CONFIG_DVB_VES1820 is not set # CONFIG_DVB_TDA10021 is not set # CONFIG_DVB_TDA10023 is not set # CONFIG_DVB_STV0297 is not set # # ATSC (North American/Korean Terrestrial/Cable DTV) frontends # # CONFIG_DVB_NXT200X is not set # CONFIG_DVB_OR51211 is not set # CONFIG_DVB_OR51132 is not set # CONFIG_DVB_BCM3510 is not set # CONFIG_DVB_LGDT330X is not set # CONFIG_DVB_LGDT3305 is not set # CONFIG_DVB_LGDT3306A is not set # CONFIG_DVB_LG2160 is not set # CONFIG_DVB_S5H1409 is not set # CONFIG_DVB_AU8522_DTV is not set # CONFIG_DVB_AU8522_V4L is not set # CONFIG_DVB_S5H1411 is not set # CONFIG_DVB_MXL692 is not set # # ISDB-T (terrestrial) frontends # # CONFIG_DVB_S921 is not set # CONFIG_DVB_DIB8000 is not set # CONFIG_DVB_MB86A20S is not set # # ISDB-S (satellite) & ISDB-T (terrestrial) frontends # # CONFIG_DVB_TC90522 is not set # CONFIG_DVB_MN88443X is not set # # Digital terrestrial only tuners/PLL # # CONFIG_DVB_PLL is not set # CONFIG_DVB_TUNER_DIB0070 is not set # CONFIG_DVB_TUNER_DIB0090 is not set # # SEC control devices for DVB-S # # CONFIG_DVB_DRX39XYJ is not set # CONFIG_DVB_LNBH25 is not set # CONFIG_DVB_LNBH29 is not set # CONFIG_DVB_LNBP21 is not set # CONFIG_DVB_LNBP22 is not set # CONFIG_DVB_ISL6405 is not set # CONFIG_DVB_ISL6421 is not set # CONFIG_DVB_ISL6423 is not set # CONFIG_DVB_A8293 is not set # CONFIG_DVB_LGS8GL5 is not set # CONFIG_DVB_LGS8GXX is not set # CONFIG_DVB_ATBM8830 is not set # CONFIG_DVB_TDA665x is not set # CONFIG_DVB_IX2505V is not set # CONFIG_DVB_M88RS2000 is not set # CONFIG_DVB_AF9033 is not set # CONFIG_DVB_HORUS3A is not set # CONFIG_DVB_ASCOT2E is not set # CONFIG_DVB_HELENE is not set # # Common Interface (EN50221) controller drivers # # CONFIG_DVB_CXD2099 is not set # CONFIG_DVB_SP2 is not set # end of Customise DVB Frontends # # Tools to develop new frontends # # CONFIG_DVB_DUMMY_FE is not set # end of Media ancillary drivers # # Graphics support # CONFIG_DRM=y CONFIG_DRM_MIPI_DSI=y # CONFIG_DRM_DP_AUX_CHARDEV is not set # CONFIG_DRM_DEBUG_MM is not set # CONFIG_DRM_DEBUG_SELFTEST is not set CONFIG_DRM_KMS_HELPER=y # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set # CONFIG_DRM_FBDEV_EMULATION is not set # CONFIG_DRM_LOAD_EDID_FIRMWARE is not set # CONFIG_DRM_DP_CEC is not set CONFIG_DRM_GEM_SHMEM_HELPER=y # # I2C encoder or helper chips # # CONFIG_DRM_I2C_CH7006 is not set # CONFIG_DRM_I2C_SIL164 is not set # CONFIG_DRM_I2C_NXP_TDA998X is not set # CONFIG_DRM_I2C_NXP_TDA9950 is not set # end of I2C encoder or helper chips # # ARM devices # # CONFIG_DRM_HDLCD is not set # CONFIG_DRM_MALI_DISPLAY is not set # CONFIG_DRM_KOMEDA is not set # end of ARM devices CONFIG_DRM_VGEM=y # CONFIG_DRM_VKMS is not set CONFIG_DRM_UDL=y # CONFIG_DRM_RCAR_DW_HDMI is not set # CONFIG_DRM_RCAR_LVDS is not set # CONFIG_DRM_VIRTIO_GPU is not set CONFIG_DRM_MSM=y CONFIG_DRM_MSM_GPU_STATE=y # CONFIG_DRM_MSM_REGISTER_LOGGING is not set # CONFIG_DRM_MSM_GPU_SUDO is not set # CONFIG_DRM_MSM_HDMI_HDCP is not set CONFIG_DRM_MSM_DP=y CONFIG_DRM_MSM_DSI=y CONFIG_DRM_MSM_DSI_28NM_PHY=y CONFIG_DRM_MSM_DSI_20NM_PHY=y CONFIG_DRM_MSM_DSI_28NM_8960_PHY=y CONFIG_DRM_MSM_DSI_14NM_PHY=y CONFIG_DRM_MSM_DSI_10NM_PHY=y CONFIG_DRM_MSM_DSI_7NM_PHY=y CONFIG_DRM_PANEL=y # # Display Panels # # CONFIG_DRM_PANEL_ABT_Y030XX067A is not set # CONFIG_DRM_PANEL_ARM_VERSATILE is not set # CONFIG_DRM_PANEL_ASUS_Z00T_TM5P5_NT35596 is not set # CONFIG_DRM_PANEL_BOE_HIMAX8279D is not set # CONFIG_DRM_PANEL_BOE_TV101WUM_NL6 is not set # CONFIG_DRM_PANEL_DSI_CM is not set # CONFIG_DRM_PANEL_LVDS is not set CONFIG_DRM_PANEL_SIMPLE=y # CONFIG_DRM_PANEL_ELIDA_KD35T133 is not set # CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02 is not set # CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D is not set # CONFIG_DRM_PANEL_ILITEK_IL9322 is not set # CONFIG_DRM_PANEL_ILITEK_ILI9881C is not set # CONFIG_DRM_PANEL_INNOLUX_P079ZCA is not set # CONFIG_DRM_PANEL_JDI_LT070ME05000 is not set # CONFIG_DRM_PANEL_KHADAS_TS050 is not set # CONFIG_DRM_PANEL_KINGDISPLAY_KD097D04 is not set # CONFIG_DRM_PANEL_LEADTEK_LTK050H3146W is not set # CONFIG_DRM_PANEL_LEADTEK_LTK500HD1829 is not set # CONFIG_DRM_PANEL_SAMSUNG_LD9040 is not set # CONFIG_DRM_PANEL_LG_LB035Q02 is not set # CONFIG_DRM_PANEL_LG_LG4573 is not set # CONFIG_DRM_PANEL_NEC_NL8048HL11 is not set # CONFIG_DRM_PANEL_NOVATEK_NT35510 is not set # CONFIG_DRM_PANEL_NOVATEK_NT36672A is not set # CONFIG_DRM_PANEL_NOVATEK_NT39016 is not set # CONFIG_DRM_PANEL_MANTIX_MLAF057WE51 is not set # CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO is not set # CONFIG_DRM_PANEL_ORISETECH_OTM8009A is not set # CONFIG_DRM_PANEL_OSD_OSD101T2587_53TS is not set # CONFIG_DRM_PANEL_PANASONIC_VVX10F034N00 is not set # CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN is not set # CONFIG_DRM_PANEL_RAYDIUM_RM67191 is not set # CONFIG_DRM_PANEL_RAYDIUM_RM68200 is not set # CONFIG_DRM_PANEL_RONBO_RB070D30 is not set # CONFIG_DRM_PANEL_SAMSUNG_S6D16D0 is not set # CONFIG_DRM_PANEL_SAMSUNG_S6E3HA2 is not set # CONFIG_DRM_PANEL_SAMSUNG_S6E63J0X03 is not set # CONFIG_DRM_PANEL_SAMSUNG_S6E63M0 is not set # CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01 is not set # CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0 is not set # CONFIG_DRM_PANEL_SAMSUNG_SOFEF00 is not set # CONFIG_DRM_PANEL_SEIKO_43WVF1G is not set # CONFIG_DRM_PANEL_SHARP_LQ101R1SX01 is not set # CONFIG_DRM_PANEL_SHARP_LS037V7DW01 is not set # CONFIG_DRM_PANEL_SHARP_LS043T1LE01 is not set # CONFIG_DRM_PANEL_SITRONIX_ST7701 is not set # CONFIG_DRM_PANEL_SITRONIX_ST7703 is not set # CONFIG_DRM_PANEL_SITRONIX_ST7789V is not set # CONFIG_DRM_PANEL_SONY_ACX424AKP is not set # CONFIG_DRM_PANEL_SONY_ACX565AKM is not set # CONFIG_DRM_PANEL_TDO_TL070WSH30 is not set # CONFIG_DRM_PANEL_TPO_TD028TTEC1 is not set # CONFIG_DRM_PANEL_TPO_TD043MTEA1 is not set # CONFIG_DRM_PANEL_TPO_TPG110 is not set # CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA is not set CONFIG_DRM_PANEL_VISIONOX_RM69299=y # CONFIG_DRM_PANEL_XINPENG_XPP055C272 is not set # end of Display Panels CONFIG_DRM_BRIDGE=y CONFIG_DRM_PANEL_BRIDGE=y # # Display Interface Bridges # # CONFIG_DRM_CDNS_DSI is not set # CONFIG_DRM_CHIPONE_ICN6211 is not set # CONFIG_DRM_CHRONTEL_CH7033 is not set # CONFIG_DRM_CROS_EC_ANX7688 is not set # CONFIG_DRM_DISPLAY_CONNECTOR is not set # CONFIG_DRM_LONTIUM_LT8912B is not set # CONFIG_DRM_LONTIUM_LT9611 is not set # CONFIG_DRM_LONTIUM_LT9611UXC is not set # CONFIG_DRM_ITE_IT66121 is not set # CONFIG_DRM_LVDS_CODEC is not set # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set # CONFIG_DRM_NWL_MIPI_DSI is not set # CONFIG_DRM_NXP_PTN3460 is not set # CONFIG_DRM_PARADE_PS8622 is not set # CONFIG_DRM_PARADE_PS8640 is not set # CONFIG_DRM_SIL_SII8620 is not set # CONFIG_DRM_SII902X is not set # CONFIG_DRM_SII9234 is not set # CONFIG_DRM_SIMPLE_BRIDGE is not set # CONFIG_DRM_THINE_THC63LVD1024 is not set # CONFIG_DRM_TOSHIBA_TC358762 is not set # CONFIG_DRM_TOSHIBA_TC358764 is not set # CONFIG_DRM_TOSHIBA_TC358767 is not set # CONFIG_DRM_TOSHIBA_TC358768 is not set # CONFIG_DRM_TOSHIBA_TC358775 is not set # CONFIG_DRM_TI_TFP410 is not set # CONFIG_DRM_TI_SN65DSI83 is not set CONFIG_DRM_TI_SN65DSI86=y # CONFIG_DRM_TI_TPD12S015 is not set # CONFIG_DRM_ANALOGIX_ANX6345 is not set # CONFIG_DRM_ANALOGIX_ANX78XX is not set # CONFIG_DRM_ANALOGIX_ANX7625 is not set # CONFIG_DRM_I2C_ADV7511 is not set # CONFIG_DRM_CDNS_MHDP8546 is not set # end of Display Interface Bridges # CONFIG_DRM_ETNAVIV is not set # CONFIG_DRM_HISI_KIRIN is not set # CONFIG_DRM_MXSFB is not set # CONFIG_DRM_ARCPGU is not set # CONFIG_DRM_GM12U320 is not set # CONFIG_DRM_SIMPLEDRM is not set # CONFIG_TINYDRM_HX8357D is not set # CONFIG_TINYDRM_ILI9225 is not set # CONFIG_TINYDRM_ILI9341 is not set # CONFIG_TINYDRM_ILI9486 is not set # CONFIG_TINYDRM_MI0283QT is not set # CONFIG_TINYDRM_REPAPER is not set # CONFIG_TINYDRM_ST7586 is not set # CONFIG_TINYDRM_ST7735R is not set # CONFIG_DRM_PL111 is not set # CONFIG_DRM_LIMA is not set # CONFIG_DRM_PANFROST is not set # CONFIG_DRM_TIDSS is not set # CONFIG_DRM_GUD is not set # CONFIG_DRM_LEGACY is not set CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y # # Frame buffer Devices # CONFIG_FB_CMDLINE=y CONFIG_FB_NOTIFY=y CONFIG_FB=y # CONFIG_FIRMWARE_EDID is not set # CONFIG_FB_FOREIGN_ENDIAN is not set CONFIG_FB_MODE_HELPERS=y # CONFIG_FB_TILEBLITTING is not set # # Frame buffer hardware drivers # # CONFIG_FB_ARMCLCD is not set # CONFIG_FB_UVESA is not set # CONFIG_FB_OPENCORES is not set # CONFIG_FB_S1D13XXX is not set # CONFIG_FB_SMSCUFX is not set # CONFIG_FB_UDL is not set # CONFIG_FB_IBM_GXT4500 is not set # CONFIG_FB_VIRTUAL is not set # CONFIG_FB_METRONOME is not set # CONFIG_FB_SIMPLE is not set # CONFIG_FB_SSD1307 is not set # end of Frame buffer Devices # # Backlight & LCD device support # # CONFIG_LCD_CLASS_DEVICE is not set CONFIG_BACKLIGHT_CLASS_DEVICE=y # CONFIG_BACKLIGHT_KTD253 is not set CONFIG_BACKLIGHT_PWM=y # CONFIG_BACKLIGHT_QCOM_WLED is not set # CONFIG_BACKLIGHT_ADP8860 is not set # CONFIG_BACKLIGHT_ADP8870 is not set # CONFIG_BACKLIGHT_LM3630A is not set # CONFIG_BACKLIGHT_LM3639 is not set CONFIG_BACKLIGHT_LP855X=y CONFIG_BACKLIGHT_GPIO=y # CONFIG_BACKLIGHT_LV5207LP is not set # CONFIG_BACKLIGHT_BD6107 is not set CONFIG_BACKLIGHT_ARCXCNN=y # CONFIG_BACKLIGHT_LED is not set # end of Backlight & LCD device support CONFIG_VIDEOMODE_HELPERS=y CONFIG_HDMI=y # CONFIG_LOGO is not set # end of Graphics support CONFIG_SOUND=y CONFIG_SND=y CONFIG_SND_TIMER=y CONFIG_SND_PCM=y CONFIG_SND_PCM_ELD=y CONFIG_SND_PCM_IEC958=y CONFIG_SND_HWDEP=m CONFIG_SND_SEQ_DEVICE=m CONFIG_SND_RAWMIDI=m CONFIG_SND_JACK=y CONFIG_SND_JACK_INPUT_DEV=y # CONFIG_SND_OSSEMUL is not set CONFIG_SND_PCM_TIMER=y CONFIG_SND_HRTIMER=m CONFIG_SND_DYNAMIC_MINORS=y CONFIG_SND_MAX_CARDS=32 CONFIG_SND_SUPPORT_OLD_API=y CONFIG_SND_PROC_FS=y CONFIG_SND_VERBOSE_PROCFS=y # CONFIG_SND_VERBOSE_PRINTK is not set # CONFIG_SND_DEBUG is not set CONFIG_SND_SEQUENCER=m CONFIG_SND_SEQ_DUMMY=m CONFIG_SND_SEQ_HRTIMER_DEFAULT=y CONFIG_SND_SEQ_MIDI_EVENT=m CONFIG_SND_SEQ_MIDI=m CONFIG_SND_DRIVERS=y # CONFIG_SND_DUMMY is not set # CONFIG_SND_ALOOP is not set # CONFIG_SND_VIRMIDI is not set # CONFIG_SND_MTPAV is not set # CONFIG_SND_MTS64 is not set # CONFIG_SND_SERIAL_U16550 is not set # CONFIG_SND_MPU401 is not set # CONFIG_SND_PORTMAN2X4 is not set # # HD-Audio # # end of HD-Audio CONFIG_SND_HDA_PREALLOC_SIZE=64 # CONFIG_SND_SPI is not set CONFIG_SND_USB=y CONFIG_SND_USB_AUDIO=m CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER=y # CONFIG_SND_USB_UA101 is not set # CONFIG_SND_USB_CAIAQ is not set # CONFIG_SND_USB_6FIRE is not set # CONFIG_SND_USB_HIFACE is not set # CONFIG_SND_BCD2000 is not set # CONFIG_SND_USB_POD is not set # CONFIG_SND_USB_PODHD is not set # CONFIG_SND_USB_TONEPORT is not set # CONFIG_SND_USB_VARIAX is not set CONFIG_SND_SOC=y # CONFIG_SND_SOC_ADI is not set # CONFIG_SND_SOC_AMD_ACP is not set # CONFIG_SND_ATMEL_SOC is not set # CONFIG_SND_BCM63XX_I2S_WHISTLER is not set # CONFIG_SND_DESIGNWARE_I2S is not set # # SoC Audio for Freescale CPUs # # # Common SoC Audio options for Freescale CPUs: # # CONFIG_SND_SOC_FSL_ASRC is not set # CONFIG_SND_SOC_FSL_SAI is not set # CONFIG_SND_SOC_FSL_AUDMIX is not set # CONFIG_SND_SOC_FSL_SSI is not set # CONFIG_SND_SOC_FSL_SPDIF is not set # CONFIG_SND_SOC_FSL_ESAI is not set # CONFIG_SND_SOC_FSL_MICFIL is not set # CONFIG_SND_SOC_FSL_XCVR is not set # CONFIG_SND_SOC_FSL_RPMSG is not set # CONFIG_SND_SOC_IMX_AUDMUX is not set # end of SoC Audio for Freescale CPUs # CONFIG_SND_I2S_HI6210_I2S is not set # CONFIG_SND_SOC_IMG is not set # CONFIG_SND_SOC_MTK_BTCVSD is not set CONFIG_SND_SOC_QCOM=y CONFIG_SND_SOC_LPASS_CPU=y CONFIG_SND_SOC_LPASS_HDMI=y CONFIG_SND_SOC_LPASS_PLATFORM=y CONFIG_SND_SOC_LPASS_SC7180=y # CONFIG_SND_SOC_STORM is not set # CONFIG_SND_SOC_APQ8016_SBC is not set CONFIG_SND_SOC_QCOM_COMMON=y CONFIG_SND_SOC_SC7180=y # CONFIG_SND_SOC_SOF_TOPLEVEL is not set # # STMicroelectronics STM32 SOC audio support # # end of STMicroelectronics STM32 SOC audio support # CONFIG_SND_SOC_XILINX_I2S is not set # CONFIG_SND_SOC_XILINX_AUDIO_FORMATTER is not set # CONFIG_SND_SOC_XILINX_SPDIF is not set # CONFIG_SND_SOC_XTFPGA_I2S is not set CONFIG_SND_SOC_I2C_AND_SPI=y # # CODEC drivers # # CONFIG_SND_SOC_AC97_CODEC is not set # CONFIG_SND_SOC_ADAU1372_I2C is not set # CONFIG_SND_SOC_ADAU1372_SPI is not set # CONFIG_SND_SOC_ADAU1701 is not set # CONFIG_SND_SOC_ADAU1761_I2C is not set # CONFIG_SND_SOC_ADAU1761_SPI is not set CONFIG_SND_SOC_ADAU7002=y # CONFIG_SND_SOC_ADAU7118_HW is not set # CONFIG_SND_SOC_ADAU7118_I2C is not set # CONFIG_SND_SOC_AK4104 is not set # CONFIG_SND_SOC_AK4118 is not set # CONFIG_SND_SOC_AK4458 is not set # CONFIG_SND_SOC_AK4554 is not set # CONFIG_SND_SOC_AK4613 is not set # CONFIG_SND_SOC_AK4642 is not set # CONFIG_SND_SOC_AK5386 is not set # CONFIG_SND_SOC_AK5558 is not set # CONFIG_SND_SOC_ALC5623 is not set # CONFIG_SND_SOC_BD28623 is not set # CONFIG_SND_SOC_BT_SCO is not set # CONFIG_SND_SOC_CROS_EC_CODEC is not set # CONFIG_SND_SOC_CS35L32 is not set # CONFIG_SND_SOC_CS35L33 is not set # CONFIG_SND_SOC_CS35L34 is not set # CONFIG_SND_SOC_CS35L35 is not set # CONFIG_SND_SOC_CS35L36 is not set # CONFIG_SND_SOC_CS42L42 is not set # CONFIG_SND_SOC_CS42L51_I2C is not set # CONFIG_SND_SOC_CS42L52 is not set # CONFIG_SND_SOC_CS42L56 is not set # CONFIG_SND_SOC_CS42L73 is not set # CONFIG_SND_SOC_CS4234 is not set # CONFIG_SND_SOC_CS4265 is not set # CONFIG_SND_SOC_CS4270 is not set # CONFIG_SND_SOC_CS4271_I2C is not set # CONFIG_SND_SOC_CS4271_SPI is not set # CONFIG_SND_SOC_CS42XX8_I2C is not set # CONFIG_SND_SOC_CS43130 is not set # CONFIG_SND_SOC_CS4341 is not set # CONFIG_SND_SOC_CS4349 is not set # CONFIG_SND_SOC_CS53L30 is not set # CONFIG_SND_SOC_CX2072X is not set # CONFIG_SND_SOC_DA7213 is not set # CONFIG_SND_SOC_DMIC is not set CONFIG_SND_SOC_HDMI_CODEC=y # CONFIG_SND_SOC_ES7134 is not set # CONFIG_SND_SOC_ES7241 is not set # CONFIG_SND_SOC_ES8316 is not set # CONFIG_SND_SOC_ES8328_I2C is not set # CONFIG_SND_SOC_ES8328_SPI is not set # CONFIG_SND_SOC_GTM601 is not set # CONFIG_SND_SOC_INNO_RK3036 is not set # CONFIG_SND_SOC_MAX98088 is not set CONFIG_SND_SOC_MAX98357A=y # CONFIG_SND_SOC_MAX98504 is not set # CONFIG_SND_SOC_MAX9867 is not set # CONFIG_SND_SOC_MAX98927 is not set # CONFIG_SND_SOC_MAX98373_I2C is not set # CONFIG_SND_SOC_MAX98390 is not set # CONFIG_SND_SOC_MAX9860 is not set # CONFIG_SND_SOC_MSM8916_WCD_ANALOG is not set # CONFIG_SND_SOC_MSM8916_WCD_DIGITAL is not set # CONFIG_SND_SOC_PCM1681 is not set # CONFIG_SND_SOC_PCM1789_I2C is not set # CONFIG_SND_SOC_PCM179X_I2C is not set # CONFIG_SND_SOC_PCM179X_SPI is not set # CONFIG_SND_SOC_PCM186X_I2C is not set # CONFIG_SND_SOC_PCM186X_SPI is not set # CONFIG_SND_SOC_PCM3060_I2C is not set # CONFIG_SND_SOC_PCM3060_SPI is not set # CONFIG_SND_SOC_PCM3168A_I2C is not set # CONFIG_SND_SOC_PCM3168A_SPI is not set # CONFIG_SND_SOC_PCM5102A is not set # CONFIG_SND_SOC_PCM512x_I2C is not set # CONFIG_SND_SOC_PCM512x_SPI is not set # CONFIG_SND_SOC_RK3328 is not set CONFIG_SND_SOC_RL6231=y # CONFIG_SND_SOC_RT5616 is not set # CONFIG_SND_SOC_RT5631 is not set # CONFIG_SND_SOC_RT5640 is not set # CONFIG_SND_SOC_RT5659 is not set CONFIG_SND_SOC_RT5682=y CONFIG_SND_SOC_RT5682_I2C=y # CONFIG_SND_SOC_SGTL5000 is not set # CONFIG_SND_SOC_SIMPLE_AMPLIFIER is not set # CONFIG_SND_SOC_SIMPLE_MUX is not set # CONFIG_SND_SOC_SPDIF is not set # CONFIG_SND_SOC_SSM2305 is not set # CONFIG_SND_SOC_SSM2518 is not set # CONFIG_SND_SOC_SSM2602_SPI is not set # CONFIG_SND_SOC_SSM2602_I2C is not set CONFIG_SND_SOC_SSM4567=m # CONFIG_SND_SOC_STA32X is not set # CONFIG_SND_SOC_STA350 is not set # CONFIG_SND_SOC_STI_SAS is not set # CONFIG_SND_SOC_TAS2552 is not set # CONFIG_SND_SOC_TAS2562 is not set # CONFIG_SND_SOC_TAS2764 is not set # CONFIG_SND_SOC_TAS2770 is not set # CONFIG_SND_SOC_TAS5086 is not set # CONFIG_SND_SOC_TAS571X is not set # CONFIG_SND_SOC_TAS5720 is not set # CONFIG_SND_SOC_TAS6424 is not set # CONFIG_SND_SOC_TDA7419 is not set # CONFIG_SND_SOC_TFA9879 is not set # CONFIG_SND_SOC_TFA989X is not set # CONFIG_SND_SOC_TLV320AIC23_I2C is not set # CONFIG_SND_SOC_TLV320AIC23_SPI is not set # CONFIG_SND_SOC_TLV320AIC31XX is not set # CONFIG_SND_SOC_TLV320AIC32X4_I2C is not set # CONFIG_SND_SOC_TLV320AIC32X4_SPI is not set # CONFIG_SND_SOC_TLV320AIC3X_I2C is not set # CONFIG_SND_SOC_TLV320AIC3X_SPI is not set # CONFIG_SND_SOC_TLV320ADCX140 is not set CONFIG_SND_SOC_TS3A227E=y # CONFIG_SND_SOC_TSCS42XX is not set # CONFIG_SND_SOC_TSCS454 is not set # CONFIG_SND_SOC_UDA1334 is not set # CONFIG_SND_SOC_WM8510 is not set # CONFIG_SND_SOC_WM8523 is not set # CONFIG_SND_SOC_WM8524 is not set # CONFIG_SND_SOC_WM8580 is not set # CONFIG_SND_SOC_WM8711 is not set # CONFIG_SND_SOC_WM8728 is not set # CONFIG_SND_SOC_WM8731 is not set # CONFIG_SND_SOC_WM8737 is not set # CONFIG_SND_SOC_WM8741 is not set # CONFIG_SND_SOC_WM8750 is not set # CONFIG_SND_SOC_WM8753 is not set # CONFIG_SND_SOC_WM8770 is not set # CONFIG_SND_SOC_WM8776 is not set # CONFIG_SND_SOC_WM8782 is not set # CONFIG_SND_SOC_WM8804_I2C is not set # CONFIG_SND_SOC_WM8804_SPI is not set # CONFIG_SND_SOC_WM8903 is not set # CONFIG_SND_SOC_WM8904 is not set # CONFIG_SND_SOC_WM8960 is not set # CONFIG_SND_SOC_WM8962 is not set # CONFIG_SND_SOC_WM8974 is not set # CONFIG_SND_SOC_WM8978 is not set # CONFIG_SND_SOC_WM8985 is not set # CONFIG_SND_SOC_ZL38060 is not set # CONFIG_SND_SOC_MAX9759 is not set # CONFIG_SND_SOC_MT6351 is not set # CONFIG_SND_SOC_MT6358 is not set # CONFIG_SND_SOC_MT6660 is not set # CONFIG_SND_SOC_NAU8315 is not set # CONFIG_SND_SOC_NAU8540 is not set # CONFIG_SND_SOC_NAU8810 is not set # CONFIG_SND_SOC_NAU8822 is not set # CONFIG_SND_SOC_NAU8824 is not set # CONFIG_SND_SOC_TPA6130A2 is not set # CONFIG_SND_SOC_LPASS_WSA_MACRO is not set # CONFIG_SND_SOC_LPASS_VA_MACRO is not set # CONFIG_SND_SOC_LPASS_RX_MACRO is not set # CONFIG_SND_SOC_LPASS_TX_MACRO is not set # end of CODEC drivers CONFIG_SND_SIMPLE_CARD_UTILS=y CONFIG_SND_SIMPLE_CARD=y # CONFIG_SND_AUDIO_GRAPH_CARD is not set # CONFIG_SND_VIRTIO is not set # # HID support # CONFIG_HID=y CONFIG_HID_BATTERY_STRENGTH=y CONFIG_HIDRAW=y CONFIG_UHID=y CONFIG_HID_GENERIC=y # # Special HID drivers # # CONFIG_HID_A4TECH is not set # CONFIG_HID_ACCUTOUCH is not set # CONFIG_HID_ACRUX is not set CONFIG_HID_APPLE=m # CONFIG_HID_APPLEIR is not set # CONFIG_HID_ASUS is not set # CONFIG_HID_AUREAL is not set # CONFIG_HID_BELKIN is not set # CONFIG_HID_BETOP_FF is not set # CONFIG_HID_BIGBEN_FF is not set CONFIG_HID_CHERRY=m CONFIG_HID_CHICONY=y # CONFIG_HID_CORSAIR is not set # CONFIG_HID_COUGAR is not set # CONFIG_HID_MACALLY is not set # CONFIG_HID_PRODIKEYS is not set # CONFIG_HID_CMEDIA is not set # CONFIG_HID_CP2112 is not set # CONFIG_HID_CREATIVE_SB0540 is not set # CONFIG_HID_CYPRESS is not set # CONFIG_HID_DRAGONRISE is not set # CONFIG_HID_EMS_FF is not set # CONFIG_HID_ELAN is not set # CONFIG_HID_ELECOM is not set # CONFIG_HID_ELO is not set # CONFIG_HID_EZKEY is not set # CONFIG_HID_FT260 is not set # CONFIG_HID_GEMBIRD is not set # CONFIG_HID_GFRM is not set # CONFIG_HID_GLORIOUS is not set CONFIG_HID_HOLTEK=y # CONFIG_HOLTEK_FF is not set # CONFIG_HID_GOOGLE_HAMMER is not set # CONFIG_HID_VIVALDI is not set # CONFIG_HID_GT683R is not set # CONFIG_HID_KEYTOUCH is not set # CONFIG_HID_KYE is not set # CONFIG_HID_UCLOGIC is not set # CONFIG_HID_WALTOP is not set # CONFIG_HID_VIEWSONIC is not set # CONFIG_HID_GYRATION is not set # CONFIG_HID_ICADE is not set # CONFIG_HID_ITE is not set # CONFIG_HID_JABRA is not set # CONFIG_HID_TWINHAN is not set CONFIG_HID_KENSINGTON=y # CONFIG_HID_LCPOWER is not set CONFIG_HID_LED=m # CONFIG_HID_LENOVO is not set CONFIG_HID_LOGITECH=m CONFIG_HID_LOGITECH_DJ=m CONFIG_HID_LOGITECH_HIDPP=m # CONFIG_LOGITECH_FF is not set # CONFIG_LOGIRUMBLEPAD2_FF is not set # CONFIG_LOGIG940_FF is not set # CONFIG_LOGIWHEELS_FF is not set CONFIG_HID_MAGICMOUSE=m # CONFIG_HID_MALTRON is not set # CONFIG_HID_MAYFLASH is not set # CONFIG_HID_REDRAGON is not set CONFIG_HID_MICROSOFT=m # CONFIG_HID_MONTEREY is not set CONFIG_HID_MULTITOUCH=y # CONFIG_HID_NTI is not set # CONFIG_HID_NTRIG is not set # CONFIG_HID_ORTEK is not set # CONFIG_HID_PANTHERLORD is not set # CONFIG_HID_PENMOUNT is not set # CONFIG_HID_PETALYNX is not set # CONFIG_HID_PICOLCD is not set CONFIG_HID_PLANTRONICS=m # CONFIG_HID_PLAYSTATION is not set CONFIG_HID_PRIMAX=m # CONFIG_HID_RETRODE is not set # CONFIG_HID_ROCCAT is not set # CONFIG_HID_SAITEK is not set # CONFIG_HID_SAMSUNG is not set # CONFIG_HID_SEMITEK is not set CONFIG_HID_SONY=m # CONFIG_SONY_FF is not set # CONFIG_HID_SPEEDLINK is not set # CONFIG_HID_STEAM is not set # CONFIG_HID_STEELSERIES is not set # CONFIG_HID_SUNPLUS is not set CONFIG_HID_RMI=m # CONFIG_HID_GREENASIA is not set # CONFIG_HID_SMARTJOYPLUS is not set # CONFIG_HID_TIVO is not set # CONFIG_HID_TOPSEED is not set CONFIG_HID_THINGM=m # CONFIG_HID_THRUSTMASTER is not set # CONFIG_HID_UDRAW_PS3 is not set # CONFIG_HID_U2FZERO is not set CONFIG_HID_WACOM=m CONFIG_HID_WIIMOTE=m # CONFIG_HID_XINMO is not set # CONFIG_HID_ZEROPLUS is not set # CONFIG_HID_ZYDACRON is not set # CONFIG_HID_SENSOR_HUB is not set # CONFIG_HID_ALPS is not set # CONFIG_HID_MCP2221 is not set # end of Special HID drivers # # USB HID support # CONFIG_USB_HID=y # CONFIG_HID_PID is not set CONFIG_USB_HIDDEV=y # end of USB HID support # # I2C HID support # CONFIG_I2C_HID_OF=y CONFIG_I2C_HID_OF_GOODIX=y # end of I2C HID support CONFIG_I2C_HID_CORE=y # end of HID support CONFIG_USB_OHCI_LITTLE_ENDIAN=y CONFIG_USB_SUPPORT=y CONFIG_USB_COMMON=y # CONFIG_USB_LED_TRIG is not set # CONFIG_USB_ULPI_BUS is not set # CONFIG_USB_CONN_GPIO is not set CONFIG_USB_ARCH_HAS_HCD=y CONFIG_USB=y CONFIG_USB_ANNOUNCE_NEW_DEVICES=y # # Miscellaneous USB options # # CONFIG_USB_DEFAULT_PERSIST is not set # CONFIG_USB_FEW_INIT_RETRIES is not set # CONFIG_USB_DYNAMIC_MINORS is not set # CONFIG_USB_OTG is not set # CONFIG_USB_OTG_PRODUCTLIST is not set # CONFIG_USB_OTG_DISABLE_EXTERNAL_HUB is not set # CONFIG_USB_LEDS_TRIGGER_USBPORT is not set CONFIG_USB_AUTOSUSPEND_DELAY=2 CONFIG_USB_MON=y # # USB Host Controller Drivers # # CONFIG_USB_C67X00_HCD is not set CONFIG_USB_XHCI_HCD=y # CONFIG_USB_XHCI_DBGCAP is not set # CONFIG_USB_XHCI_PCI_RENESAS is not set CONFIG_USB_XHCI_PLATFORM=y CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_ROOT_HUB_TT=y CONFIG_USB_EHCI_TT_NEWSCHED=y # CONFIG_USB_EHCI_FSL is not set CONFIG_USB_EHCI_HCD_PLATFORM=y # CONFIG_USB_OXU210HP_HCD is not set # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_FOTG210_HCD is not set # CONFIG_USB_MAX3421_HCD is not set CONFIG_USB_OHCI_HCD=y CONFIG_USB_OHCI_HCD_PLATFORM=y # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set # CONFIG_USB_HCD_TEST_MODE is not set # # USB Device Class drivers # CONFIG_USB_ACM=y # CONFIG_USB_PRINTER is not set CONFIG_USB_WDM=m # CONFIG_USB_TMC is not set # # NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may # # # also be needed; see USB_STORAGE Help for more info # CONFIG_USB_STORAGE=y # CONFIG_USB_STORAGE_DEBUG is not set # CONFIG_USB_STORAGE_REALTEK is not set # CONFIG_USB_STORAGE_DATAFAB is not set # CONFIG_USB_STORAGE_FREECOM is not set # CONFIG_USB_STORAGE_ISD200 is not set # CONFIG_USB_STORAGE_USBAT is not set # CONFIG_USB_STORAGE_SDDR09 is not set # CONFIG_USB_STORAGE_SDDR55 is not set # CONFIG_USB_STORAGE_JUMPSHOT is not set # CONFIG_USB_STORAGE_ALAUDA is not set # CONFIG_USB_STORAGE_ONETOUCH is not set # CONFIG_USB_STORAGE_KARMA is not set # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set # CONFIG_USB_STORAGE_ENE_UB6250 is not set CONFIG_USB_UAS=y # # USB Imaging devices # # CONFIG_USB_MDC800 is not set # CONFIG_USB_MICROTEK is not set # CONFIG_USBIP_CORE is not set # CONFIG_USB_CDNS_SUPPORT is not set # CONFIG_USB_MUSB_HDRC is not set CONFIG_USB_DWC3=y # CONFIG_USB_DWC3_HOST is not set # CONFIG_USB_DWC3_GADGET is not set CONFIG_USB_DWC3_DUAL_ROLE=y # # Platform Glue Driver Support # CONFIG_USB_DWC3_OF_SIMPLE=y CONFIG_USB_DWC3_QCOM=y # CONFIG_USB_DWC2 is not set # CONFIG_USB_CHIPIDEA is not set # CONFIG_USB_ISP1760 is not set # # USB port drivers # # CONFIG_USB_USS720 is not set CONFIG_USB_SERIAL=y # CONFIG_USB_SERIAL_CONSOLE is not set CONFIG_USB_SERIAL_GENERIC=y CONFIG_USB_SERIAL_SIMPLE=m # CONFIG_USB_SERIAL_AIRCABLE is not set # CONFIG_USB_SERIAL_ARK3116 is not set # CONFIG_USB_SERIAL_BELKIN is not set CONFIG_USB_SERIAL_CH341=m # CONFIG_USB_SERIAL_WHITEHEAT is not set # CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set CONFIG_USB_SERIAL_CP210X=m # CONFIG_USB_SERIAL_CYPRESS_M8 is not set # CONFIG_USB_SERIAL_EMPEG is not set CONFIG_USB_SERIAL_FTDI_SIO=m # CONFIG_USB_SERIAL_VISOR is not set # CONFIG_USB_SERIAL_IPAQ is not set # CONFIG_USB_SERIAL_IR is not set # CONFIG_USB_SERIAL_EDGEPORT is not set # CONFIG_USB_SERIAL_EDGEPORT_TI is not set # CONFIG_USB_SERIAL_F81232 is not set # CONFIG_USB_SERIAL_F8153X is not set # CONFIG_USB_SERIAL_GARMIN is not set # CONFIG_USB_SERIAL_IPW is not set # CONFIG_USB_SERIAL_IUU is not set # CONFIG_USB_SERIAL_KEYSPAN_PDA is not set CONFIG_USB_SERIAL_KEYSPAN=m # CONFIG_USB_SERIAL_KLSI is not set # CONFIG_USB_SERIAL_KOBIL_SCT is not set # CONFIG_USB_SERIAL_MCT_U232 is not set # CONFIG_USB_SERIAL_METRO is not set # CONFIG_USB_SERIAL_MOS7720 is not set # CONFIG_USB_SERIAL_MOS7840 is not set # CONFIG_USB_SERIAL_MXUPORT is not set # CONFIG_USB_SERIAL_NAVMAN is not set CONFIG_USB_SERIAL_PL2303=m CONFIG_USB_SERIAL_OTI6858=m # CONFIG_USB_SERIAL_QCAUX is not set CONFIG_USB_SERIAL_QUALCOMM=m # CONFIG_USB_SERIAL_SPCP8X5 is not set # CONFIG_USB_SERIAL_SAFE is not set CONFIG_USB_SERIAL_SIERRAWIRELESS=m # CONFIG_USB_SERIAL_SYMBOL is not set # CONFIG_USB_SERIAL_TI is not set # CONFIG_USB_SERIAL_CYBERJACK is not set CONFIG_USB_SERIAL_WWAN=m CONFIG_USB_SERIAL_OPTION=m # CONFIG_USB_SERIAL_OMNINET is not set # CONFIG_USB_SERIAL_OPTICON is not set # CONFIG_USB_SERIAL_XSENS_MT is not set # CONFIG_USB_SERIAL_WISHBONE is not set # CONFIG_USB_SERIAL_SSU100 is not set # CONFIG_USB_SERIAL_QT2 is not set # CONFIG_USB_SERIAL_UPD78F0730 is not set # CONFIG_USB_SERIAL_XR is not set # CONFIG_USB_SERIAL_DEBUG is not set # # USB Miscellaneous drivers # # CONFIG_USB_EMI62 is not set # CONFIG_USB_EMI26 is not set # CONFIG_USB_ADUTUX is not set # CONFIG_USB_SEVSEG is not set # CONFIG_USB_LEGOTOWER is not set # CONFIG_USB_LCD is not set # CONFIG_USB_CYPRESS_CY7C63 is not set # CONFIG_USB_CYTHERM is not set # CONFIG_USB_IDMOUSE is not set # CONFIG_USB_FTDI_ELAN is not set # CONFIG_USB_APPLEDISPLAY is not set # CONFIG_APPLE_MFI_FASTCHARGE is not set # CONFIG_USB_SISUSBVGA is not set # CONFIG_USB_LD is not set # CONFIG_USB_TRANCEVIBRATOR is not set # CONFIG_USB_IOWARRIOR is not set # CONFIG_USB_TEST is not set # CONFIG_USB_EHSET_TEST_FIXTURE is not set # CONFIG_USB_ISIGHTFW is not set # CONFIG_USB_YUREX is not set CONFIG_USB_EZUSB_FX2=m # CONFIG_USB_HUB_USB251XB is not set # CONFIG_USB_HSIC_USB3503 is not set # CONFIG_USB_HSIC_USB4604 is not set # CONFIG_USB_LINK_LAYER_TEST is not set # CONFIG_USB_CHAOSKEY is not set # # USB Physical Layer drivers # # CONFIG_NOP_USB_XCEIV is not set # CONFIG_USB_GPIO_VBUS is not set # CONFIG_USB_ISP1301 is not set CONFIG_USB_ULPI=y CONFIG_USB_ULPI_VIEWPORT=y # end of USB Physical Layer drivers CONFIG_USB_GADGET=y # CONFIG_USB_GADGET_DEBUG is not set # CONFIG_USB_GADGET_DEBUG_FILES is not set # CONFIG_USB_GADGET_DEBUG_FS is not set CONFIG_USB_GADGET_VBUS_DRAW=2 CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 # # USB Peripheral Controller # # CONFIG_USB_FOTG210_UDC is not set # CONFIG_USB_GR_UDC is not set # CONFIG_USB_R8A66597 is not set # CONFIG_USB_PXA27X is not set # CONFIG_USB_MV_UDC is not set # CONFIG_USB_MV_U3D is not set # CONFIG_USB_SNP_UDC_PLAT is not set # CONFIG_USB_M66592 is not set # CONFIG_USB_BDC_UDC is not set # CONFIG_USB_NET2272 is not set # CONFIG_USB_GADGET_XILINX is not set # CONFIG_USB_MAX3420_UDC is not set # CONFIG_USB_DUMMY_HCD is not set # end of USB Peripheral Controller CONFIG_USB_LIBCOMPOSITE=m CONFIG_USB_F_FS=m CONFIG_USB_CONFIGFS=m # CONFIG_USB_CONFIGFS_SERIAL is not set # CONFIG_USB_CONFIGFS_ACM is not set # CONFIG_USB_CONFIGFS_OBEX is not set # CONFIG_USB_CONFIGFS_NCM is not set # CONFIG_USB_CONFIGFS_ECM is not set # CONFIG_USB_CONFIGFS_ECM_SUBSET is not set # CONFIG_USB_CONFIGFS_RNDIS is not set # CONFIG_USB_CONFIGFS_EEM is not set # CONFIG_USB_CONFIGFS_MASS_STORAGE is not set # CONFIG_USB_CONFIGFS_F_LB_SS is not set CONFIG_USB_CONFIGFS_F_FS=y # CONFIG_USB_CONFIGFS_F_UAC1 is not set # CONFIG_USB_CONFIGFS_F_UAC1_LEGACY is not set # CONFIG_USB_CONFIGFS_F_UAC2 is not set # CONFIG_USB_CONFIGFS_F_MIDI is not set # CONFIG_USB_CONFIGFS_F_HID is not set # CONFIG_USB_CONFIGFS_F_UVC is not set # CONFIG_USB_CONFIGFS_F_PRINTER is not set # # USB Gadget precomposed configurations # # CONFIG_USB_ZERO is not set # CONFIG_USB_AUDIO is not set # CONFIG_USB_ETH is not set # CONFIG_USB_G_NCM is not set # CONFIG_USB_GADGETFS is not set # CONFIG_USB_FUNCTIONFS is not set # CONFIG_USB_MASS_STORAGE is not set # CONFIG_USB_G_SERIAL is not set # CONFIG_USB_MIDI_GADGET is not set # CONFIG_USB_G_PRINTER is not set # CONFIG_USB_CDC_COMPOSITE is not set # CONFIG_USB_G_ACM_MS is not set # CONFIG_USB_G_MULTI is not set # CONFIG_USB_G_HID is not set # CONFIG_USB_G_DBGP is not set # CONFIG_USB_G_WEBCAM is not set # CONFIG_USB_RAW_GADGET is not set # end of USB Gadget precomposed configurations CONFIG_TYPEC=m # CONFIG_TYPEC_TCPM is not set # CONFIG_TYPEC_UCSI is not set # CONFIG_TYPEC_TPS6598X is not set # CONFIG_TYPEC_HD3SS3220 is not set # CONFIG_TYPEC_STUSB160X is not set # CONFIG_TYPEC_QCOM_PMIC is not set # # USB Type-C Multiplexer/DeMultiplexer Switch support # # CONFIG_TYPEC_MUX_PI3USB30532 is not set # end of USB Type-C Multiplexer/DeMultiplexer Switch support # # USB Type-C Alternate Mode drivers # # CONFIG_TYPEC_DP_ALTMODE is not set # end of USB Type-C Alternate Mode drivers CONFIG_USB_ROLE_SWITCH=y CONFIG_MMC=y CONFIG_PWRSEQ_EMMC=y # CONFIG_PWRSEQ_SD8787 is not set CONFIG_PWRSEQ_SIMPLE=y CONFIG_MMC_BLOCK=y CONFIG_MMC_BLOCK_MINORS=16 # CONFIG_SDIO_UART is not set CONFIG_MMC_TEST=m # # MMC/SD/SDIO Host Controller Drivers # # CONFIG_MMC_DEBUG is not set # CONFIG_MMC_ARMMMCI is not set CONFIG_MMC_SDHCI=y CONFIG_MMC_SDHCI_IO_ACCESSORS=y CONFIG_MMC_SDHCI_PLTFM=y CONFIG_MMC_SDHCI_OF_ARASAN=y # CONFIG_MMC_SDHCI_OF_ASPEED is not set # CONFIG_MMC_SDHCI_OF_AT91 is not set # CONFIG_MMC_SDHCI_OF_DWCMSHC is not set # CONFIG_MMC_SDHCI_CADENCE is not set # CONFIG_MMC_SDHCI_F_SDH30 is not set # CONFIG_MMC_SDHCI_MILBEAUT is not set CONFIG_MMC_SDHCI_MSM=y # CONFIG_MMC_SPI is not set # CONFIG_MMC_DW is not set # CONFIG_MMC_VUB300 is not set # CONFIG_MMC_USHC is not set # CONFIG_MMC_USDHI6ROL0 is not set CONFIG_MMC_CQHCI=y # CONFIG_MMC_HSQ is not set # CONFIG_MMC_MTK is not set # CONFIG_MMC_SDHCI_XENON is not set # CONFIG_MMC_SDHCI_OMAP is not set # CONFIG_MMC_SDHCI_AM654 is not set # CONFIG_MEMSTICK is not set CONFIG_NEW_LEDS=y CONFIG_LEDS_CLASS=y # CONFIG_LEDS_CLASS_FLASH is not set # CONFIG_LEDS_CLASS_MULTICOLOR is not set # CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set # # LED drivers # # CONFIG_LEDS_AN30259A is not set # CONFIG_LEDS_AW2013 is not set # CONFIG_LEDS_BCM6328 is not set # CONFIG_LEDS_BCM6358 is not set # CONFIG_LEDS_CR0014114 is not set # CONFIG_LEDS_EL15203000 is not set # CONFIG_LEDS_LM3530 is not set # CONFIG_LEDS_LM3532 is not set # CONFIG_LEDS_LM3642 is not set # CONFIG_LEDS_LM3692X is not set # CONFIG_LEDS_MT6323 is not set # CONFIG_LEDS_PCA9532 is not set # CONFIG_LEDS_GPIO is not set # CONFIG_LEDS_LP3944 is not set # CONFIG_LEDS_LP3952 is not set # CONFIG_LEDS_LP50XX is not set # CONFIG_LEDS_LP55XX_COMMON is not set # CONFIG_LEDS_LP8860 is not set # CONFIG_LEDS_PCA955X is not set # CONFIG_LEDS_PCA963X is not set # CONFIG_LEDS_DAC124S085 is not set CONFIG_LEDS_PWM=y # CONFIG_LEDS_REGULATOR is not set # CONFIG_LEDS_BD2802 is not set # CONFIG_LEDS_LT3593 is not set # CONFIG_LEDS_TCA6507 is not set # CONFIG_LEDS_TLC591XX is not set # CONFIG_LEDS_LM355x is not set # CONFIG_LEDS_IS31FL319X is not set # CONFIG_LEDS_IS31FL32XX is not set # # LED driver for blink(1) USB RGB LED is under Special HID drivers (HID_THINGM) # # CONFIG_LEDS_BLINKM is not set # CONFIG_LEDS_SYSCON is not set # CONFIG_LEDS_MLXREG is not set # CONFIG_LEDS_USER is not set # CONFIG_LEDS_SPI_BYTE is not set # CONFIG_LEDS_TI_LMU_COMMON is not set # # Flash and Torch LED drivers # # # LED Triggers # CONFIG_LEDS_TRIGGERS=y # CONFIG_LEDS_TRIGGER_TIMER is not set # CONFIG_LEDS_TRIGGER_ONESHOT is not set # CONFIG_LEDS_TRIGGER_MTD is not set # CONFIG_LEDS_TRIGGER_HEARTBEAT is not set # CONFIG_LEDS_TRIGGER_BACKLIGHT is not set # CONFIG_LEDS_TRIGGER_CPU is not set # CONFIG_LEDS_TRIGGER_ACTIVITY is not set # CONFIG_LEDS_TRIGGER_GPIO is not set # CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set # # iptables trigger is under Netfilter config (LED target) # # CONFIG_LEDS_TRIGGER_TRANSIENT is not set # CONFIG_LEDS_TRIGGER_CAMERA is not set # CONFIG_LEDS_TRIGGER_PANIC is not set # CONFIG_LEDS_TRIGGER_NETDEV is not set # CONFIG_LEDS_TRIGGER_PATTERN is not set # CONFIG_LEDS_TRIGGER_AUDIO is not set # CONFIG_LEDS_TRIGGER_TTY is not set # CONFIG_ACCESSIBILITY is not set # CONFIG_INFINIBAND is not set CONFIG_EDAC_SUPPORT=y CONFIG_EDAC=y # CONFIG_EDAC_LEGACY_SYSFS is not set # CONFIG_EDAC_DEBUG is not set # CONFIG_EDAC_XGENE is not set CONFIG_EDAC_QCOM=y # CONFIG_EDAC_DMC520 is not set CONFIG_RTC_LIB=y CONFIG_RTC_CLASS=y CONFIG_RTC_HCTOSYS=y CONFIG_RTC_HCTOSYS_DEVICE="rtc0" CONFIG_RTC_SYSTOHC=y CONFIG_RTC_SYSTOHC_DEVICE="rtc0" # CONFIG_RTC_DEBUG is not set CONFIG_RTC_NVMEM=y # # RTC interfaces # CONFIG_RTC_INTF_SYSFS=y CONFIG_RTC_INTF_PROC=y CONFIG_RTC_INTF_DEV=y # CONFIG_RTC_INTF_DEV_UIE_EMUL is not set # CONFIG_RTC_DRV_TEST is not set # # I2C RTC drivers # # CONFIG_RTC_DRV_ABB5ZES3 is not set # CONFIG_RTC_DRV_ABEOZ9 is not set # CONFIG_RTC_DRV_ABX80X is not set # CONFIG_RTC_DRV_AS3722 is not set # CONFIG_RTC_DRV_DS1307 is not set # CONFIG_RTC_DRV_DS1374 is not set # CONFIG_RTC_DRV_DS1672 is not set # CONFIG_RTC_DRV_HYM8563 is not set # CONFIG_RTC_DRV_MAX6900 is not set # CONFIG_RTC_DRV_RS5C372 is not set # CONFIG_RTC_DRV_ISL1208 is not set # CONFIG_RTC_DRV_ISL12022 is not set # CONFIG_RTC_DRV_ISL12026 is not set # CONFIG_RTC_DRV_X1205 is not set # CONFIG_RTC_DRV_PCF8523 is not set # CONFIG_RTC_DRV_PCF85063 is not set # CONFIG_RTC_DRV_PCF85363 is not set # CONFIG_RTC_DRV_PCF8563 is not set # CONFIG_RTC_DRV_PCF8583 is not set # CONFIG_RTC_DRV_M41T80 is not set # CONFIG_RTC_DRV_BQ32K is not set # CONFIG_RTC_DRV_TPS6586X is not set # CONFIG_RTC_DRV_S35390A is not set # CONFIG_RTC_DRV_FM3130 is not set # CONFIG_RTC_DRV_RX8010 is not set # CONFIG_RTC_DRV_RX8581 is not set # CONFIG_RTC_DRV_RX8025 is not set # CONFIG_RTC_DRV_EM3027 is not set # CONFIG_RTC_DRV_RV3028 is not set # CONFIG_RTC_DRV_RV3032 is not set # CONFIG_RTC_DRV_RV8803 is not set # CONFIG_RTC_DRV_SD3078 is not set # # SPI RTC drivers # # CONFIG_RTC_DRV_M41T93 is not set # CONFIG_RTC_DRV_M41T94 is not set # CONFIG_RTC_DRV_DS1302 is not set # CONFIG_RTC_DRV_DS1305 is not set # CONFIG_RTC_DRV_DS1343 is not set # CONFIG_RTC_DRV_DS1347 is not set # CONFIG_RTC_DRV_DS1390 is not set # CONFIG_RTC_DRV_MAX6916 is not set # CONFIG_RTC_DRV_R9701 is not set # CONFIG_RTC_DRV_RX4581 is not set # CONFIG_RTC_DRV_RS5C348 is not set # CONFIG_RTC_DRV_MAX6902 is not set # CONFIG_RTC_DRV_PCF2123 is not set # CONFIG_RTC_DRV_MCP795 is not set CONFIG_RTC_I2C_AND_SPI=y # # SPI and I2C RTC drivers # # CONFIG_RTC_DRV_DS3232 is not set # CONFIG_RTC_DRV_PCF2127 is not set # CONFIG_RTC_DRV_RV3029C2 is not set # CONFIG_RTC_DRV_RX6110 is not set # # Platform RTC drivers # # CONFIG_RTC_DRV_DS1286 is not set # CONFIG_RTC_DRV_DS1511 is not set # CONFIG_RTC_DRV_DS1553 is not set # CONFIG_RTC_DRV_DS1685_FAMILY is not set # CONFIG_RTC_DRV_DS1742 is not set # CONFIG_RTC_DRV_DS2404 is not set # CONFIG_RTC_DRV_STK17TA8 is not set # CONFIG_RTC_DRV_M48T86 is not set # CONFIG_RTC_DRV_M48T35 is not set # CONFIG_RTC_DRV_M48T59 is not set # CONFIG_RTC_DRV_MSM6242 is not set # CONFIG_RTC_DRV_BQ4802 is not set # CONFIG_RTC_DRV_RP5C01 is not set # CONFIG_RTC_DRV_V3020 is not set # CONFIG_RTC_DRV_ZYNQMP is not set CONFIG_RTC_DRV_CROS_EC=y # # on-CPU RTC drivers # # CONFIG_RTC_DRV_PL030 is not set # CONFIG_RTC_DRV_PL031 is not set # CONFIG_RTC_DRV_CADENCE is not set # CONFIG_RTC_DRV_FTRTC010 is not set # CONFIG_RTC_DRV_PM8XXX is not set # CONFIG_RTC_DRV_MT6397 is not set # CONFIG_RTC_DRV_R7301 is not set # # HID Sensor RTC drivers # # CONFIG_RTC_DRV_GOLDFISH is not set CONFIG_DMADEVICES=y # CONFIG_DMADEVICES_DEBUG is not set # # DMA Devices # CONFIG_DMA_ENGINE=y CONFIG_DMA_OF=y # CONFIG_ALTERA_MSGDMA is not set # CONFIG_AMBA_PL08X is not set # CONFIG_DW_AXI_DMAC is not set # CONFIG_FSL_EDMA is not set # CONFIG_FSL_QDMA is not set # CONFIG_INTEL_IDMA64 is not set # CONFIG_MV_XOR_V2 is not set CONFIG_PL330_DMA=y # CONFIG_XILINX_DMA is not set # CONFIG_XILINX_ZYNQMP_DMA is not set # CONFIG_XILINX_ZYNQMP_DPDMA is not set # CONFIG_QCOM_BAM_DMA is not set # CONFIG_QCOM_GPI_DMA is not set # CONFIG_QCOM_HIDMA_MGMT is not set # CONFIG_QCOM_HIDMA is not set # CONFIG_DW_DMAC is not set # CONFIG_SF_PDMA is not set # # DMA Clients # # CONFIG_ASYNC_TX_DMA is not set # CONFIG_DMATEST is not set # # DMABUF options # CONFIG_SYNC_FILE=y CONFIG_SW_SYNC=y CONFIG_UDMABUF=y # CONFIG_DMABUF_MOVE_NOTIFY is not set CONFIG_DMABUF_DEBUG=y # CONFIG_DMABUF_SELFTESTS is not set # CONFIG_DMABUF_HEAPS is not set # end of DMABUF options # CONFIG_AUXDISPLAY is not set # CONFIG_PANEL is not set # CONFIG_UIO is not set # CONFIG_VFIO is not set # CONFIG_VIRT_DRIVERS is not set CONFIG_VIRTIO=y CONFIG_VIRTIO_MENU=y # CONFIG_VIRTIO_BALLOON is not set # CONFIG_VIRTIO_INPUT is not set # CONFIG_VIRTIO_MMIO is not set # CONFIG_VDPA is not set CONFIG_VHOST_IOTLB=m CONFIG_VHOST=m CONFIG_VHOST_MENU=y # CONFIG_VHOST_NET is not set CONFIG_VHOST_VSOCK=m # CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set # # Microsoft Hyper-V guest support # # end of Microsoft Hyper-V guest support # CONFIG_GREYBUS is not set # CONFIG_COMEDI is not set CONFIG_STAGING=y # CONFIG_PRISM2_USB is not set # CONFIG_RTLLIB is not set # CONFIG_RTL8723BS is not set # CONFIG_R8712U is not set # CONFIG_R8188EU is not set # CONFIG_VT6656 is not set # # IIO staging drivers # # # Accelerometers # # CONFIG_ADIS16203 is not set # CONFIG_ADIS16240 is not set # end of Accelerometers # # Analog to digital converters # # CONFIG_AD7816 is not set # CONFIG_AD7280 is not set # end of Analog to digital converters # # Analog digital bi-direction converters # # CONFIG_ADT7316 is not set # end of Analog digital bi-direction converters # # Capacitance to digital converters # # CONFIG_AD7746 is not set # end of Capacitance to digital converters # # Direct Digital Synthesis # # CONFIG_AD9832 is not set # CONFIG_AD9834 is not set # end of Direct Digital Synthesis # # Network Analyzer, Impedance Converters # # CONFIG_AD5933 is not set # end of Network Analyzer, Impedance Converters # # Active energy metering IC # # CONFIG_ADE7854 is not set # end of Active energy metering IC # # Resolver to digital converters # # CONFIG_AD2S1210 is not set # end of Resolver to digital converters # end of IIO staging drivers # CONFIG_STAGING_MEDIA is not set # # Android # CONFIG_ASHMEM=y # end of Android # CONFIG_STAGING_BOARD is not set # CONFIG_LTE_GDM724X is not set # CONFIG_GS_FPGABOOT is not set # CONFIG_UNISYSSPAR is not set # CONFIG_FB_TFT is not set # CONFIG_KS7010 is not set # CONFIG_PI433 is not set # CONFIG_XIL_AXIS_FIFO is not set # CONFIG_FIELDBUS_DEV is not set # CONFIG_WFX is not set # CONFIG_MFD_HI6421_SPMI is not set # CONFIG_GOLDFISH is not set CONFIG_CHROME_PLATFORMS=y CONFIG_CROS_EC=y # CONFIG_CROS_EC_I2C is not set # CONFIG_CROS_EC_RPMSG is not set CONFIG_CROS_EC_SPI=y CONFIG_CROS_EC_PROTO=y CONFIG_CROS_EC_CHARDEV=y CONFIG_CROS_EC_LIGHTBAR=y CONFIG_CROS_EC_VBC=y CONFIG_CROS_EC_DEBUGFS=y CONFIG_CROS_EC_SENSORHUB=y CONFIG_CROS_EC_SYSFS=y CONFIG_CROS_EC_TYPEC=m CONFIG_CROS_USBPD_LOGGER=y CONFIG_CROS_USBPD_NOTIFY=y # CONFIG_MELLANOX_PLATFORM is not set CONFIG_HAVE_CLK=y CONFIG_HAVE_CLK_PREPARE=y CONFIG_COMMON_CLK=y # # Clock driver for ARM Reference designs # # CONFIG_ICST is not set # CONFIG_CLK_SP810 is not set # end of Clock driver for ARM Reference designs # CONFIG_LMK04832 is not set # CONFIG_COMMON_CLK_MAX9485 is not set # CONFIG_COMMON_CLK_SI5341 is not set # CONFIG_COMMON_CLK_SI5351 is not set # CONFIG_COMMON_CLK_SI514 is not set # CONFIG_COMMON_CLK_SI544 is not set # CONFIG_COMMON_CLK_SI570 is not set # CONFIG_COMMON_CLK_CDCE706 is not set # CONFIG_COMMON_CLK_CDCE925 is not set # CONFIG_COMMON_CLK_CS2000_CP is not set # CONFIG_COMMON_CLK_AXI_CLKGEN is not set # CONFIG_COMMON_CLK_XGENE is not set # CONFIG_COMMON_CLK_PWM is not set # CONFIG_COMMON_CLK_VC5 is not set # CONFIG_COMMON_CLK_FIXED_MMIO is not set CONFIG_QCOM_GDSC=y CONFIG_COMMON_CLK_QCOM=y # CONFIG_QCOM_A53PLL is not set # CONFIG_QCOM_A7PLL is not set # CONFIG_QCOM_CLK_APCS_MSM8916 is not set # CONFIG_QCOM_CLK_APCC_MSM8996 is not set # CONFIG_QCOM_CLK_APCS_SDX55 is not set # CONFIG_QCOM_CLK_SMD_RPM is not set CONFIG_QCOM_CLK_RPMH=y # CONFIG_APQ_GCC_8084 is not set # CONFIG_APQ_MMCC_8084 is not set # CONFIG_IPQ_APSS_PLL is not set # CONFIG_IPQ_APSS_6018 is not set # CONFIG_IPQ_GCC_4019 is not set # CONFIG_IPQ_GCC_6018 is not set # CONFIG_IPQ_GCC_806X is not set # CONFIG_IPQ_LCC_806X is not set # CONFIG_IPQ_GCC_8074 is not set # CONFIG_MSM_GCC_8660 is not set CONFIG_MSM_GCC_8916=y # CONFIG_MSM_GCC_8939 is not set # CONFIG_MSM_GCC_8960 is not set # CONFIG_MSM_LCC_8960 is not set # CONFIG_MDM_GCC_9607 is not set # CONFIG_MDM_GCC_9615 is not set # CONFIG_MDM_LCC_9615 is not set # CONFIG_MSM_MMCC_8960 is not set # CONFIG_MSM_GCC_8974 is not set # CONFIG_MSM_MMCC_8974 is not set # CONFIG_MSM_GCC_8994 is not set # CONFIG_MSM_GCC_8996 is not set # CONFIG_MSM_MMCC_8996 is not set # CONFIG_MSM_GCC_8998 is not set # CONFIG_MSM_GPUCC_8998 is not set # CONFIG_MSM_MMCC_8998 is not set # CONFIG_QCS_GCC_404 is not set # CONFIG_SC_CAMCC_7180 is not set CONFIG_SC_DISPCC_7180=y CONFIG_SC_GCC_7180=y # CONFIG_SC_GCC_7280 is not set # CONFIG_SC_GCC_8180X is not set CONFIG_SC_LPASS_CORECC_7180=y CONFIG_SC_GPUCC_7180=y CONFIG_SC_MSS_7180=y CONFIG_SC_VIDEOCC_7180=y # CONFIG_SDM_CAMCC_845 is not set # CONFIG_SDM_GCC_660 is not set # CONFIG_SDM_MMCC_660 is not set # CONFIG_SDM_GPUCC_660 is not set # CONFIG_QCS_TURING_404 is not set # CONFIG_QCS_Q6SSTOP_404 is not set CONFIG_SDM_GCC_845=y CONFIG_SDM_GPUCC_845=y CONFIG_SDM_VIDEOCC_845=y CONFIG_SDM_DISPCC_845=y CONFIG_SDM_LPASSCC_845=y # CONFIG_SDX_GCC_55 is not set # CONFIG_SM_CAMCC_8250 is not set # CONFIG_SM_GCC_6125 is not set # CONFIG_SM_GCC_8150 is not set # CONFIG_SM_GCC_8250 is not set # CONFIG_SM_GCC_8350 is not set # CONFIG_SM_GPUCC_8150 is not set # CONFIG_SM_GPUCC_8250 is not set # CONFIG_SM_VIDEOCC_8150 is not set # CONFIG_SM_VIDEOCC_8250 is not set # CONFIG_SPMI_PMIC_CLKDIV is not set # CONFIG_QCOM_HFPLL is not set # CONFIG_KPSS_XCC is not set # CONFIG_CLK_GFM_LPASS_SM8250 is not set # CONFIG_XILINX_VCU is not set CONFIG_HWSPINLOCK=y CONFIG_HWSPINLOCK_QCOM=y # # Clock Source drivers # CONFIG_TIMER_OF=y CONFIG_TIMER_PROBE=y CONFIG_ARM_ARCH_TIMER=y CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y CONFIG_FSL_ERRATUM_A008585=y CONFIG_HISILICON_ERRATUM_161010101=y CONFIG_ARM64_ERRATUM_858921=y # CONFIG_MICROCHIP_PIT64B is not set # end of Clock Source drivers CONFIG_MAILBOX=y # CONFIG_ARM_MHU is not set # CONFIG_ARM_MHU_V2 is not set # CONFIG_PLATFORM_MHU is not set # CONFIG_PL320_MBOX is not set # CONFIG_ALTERA_MBOX is not set # CONFIG_MAILBOX_TEST is not set CONFIG_QCOM_APCS_IPC=y # CONFIG_QCOM_IPCC is not set CONFIG_IOMMU_IOVA=y CONFIG_IOMMU_API=y CONFIG_IOMMU_SUPPORT=y # # Generic IOMMU Pagetable Support # CONFIG_IOMMU_IO_PGTABLE=y CONFIG_IOMMU_IO_PGTABLE_LPAE=y # CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set # CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set # end of Generic IOMMU Pagetable Support # CONFIG_IOMMU_DEBUGFS is not set # CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set CONFIG_OF_IOMMU=y CONFIG_IOMMU_DMA=y CONFIG_ARM_SMMU=y # CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT=y # CONFIG_ARM_SMMU_V3 is not set # CONFIG_QCOM_IOMMU is not set # CONFIG_VIRTIO_IOMMU is not set # # Remoteproc drivers # CONFIG_REMOTEPROC=y # CONFIG_REMOTEPROC_CDEV is not set CONFIG_QCOM_PIL_INFO=m CONFIG_QCOM_RPROC_COMMON=m CONFIG_QCOM_Q6V5_COMMON=m # CONFIG_QCOM_Q6V5_ADSP is not set CONFIG_QCOM_Q6V5_MSS=m # CONFIG_QCOM_Q6V5_PAS is not set # CONFIG_QCOM_Q6V5_WCSS is not set # CONFIG_QCOM_SYSMON is not set # CONFIG_QCOM_WCNSS_PIL is not set # end of Remoteproc drivers # # Rpmsg drivers # CONFIG_RPMSG=y CONFIG_RPMSG_CHAR=y # CONFIG_RPMSG_NS is not set CONFIG_RPMSG_QCOM_GLINK=y # CONFIG_RPMSG_QCOM_GLINK_RPM is not set CONFIG_RPMSG_QCOM_GLINK_SMEM=y CONFIG_RPMSG_QCOM_SMD=y # CONFIG_RPMSG_VIRTIO is not set # end of Rpmsg drivers # CONFIG_SOUNDWIRE is not set # # SOC (System On Chip) specific Drivers # # # Amlogic SoC drivers # # end of Amlogic SoC drivers # # Broadcom SoC drivers # # CONFIG_SOC_BRCMSTB is not set # end of Broadcom SoC drivers # # NXP/Freescale QorIQ SoC drivers # # CONFIG_QUICC_ENGINE is not set # CONFIG_FSL_RCPM is not set # end of NXP/Freescale QorIQ SoC drivers # # i.MX SoC drivers # # end of i.MX SoC drivers # # Enable LiteX SoC Builder specific drivers # # CONFIG_LITEX_SOC_CONTROLLER is not set # end of Enable LiteX SoC Builder specific drivers # # Qualcomm SoC drivers # CONFIG_QCOM_AOSS_QMP=y CONFIG_QCOM_COMMAND_DB=y # CONFIG_QCOM_CPR is not set CONFIG_QCOM_GENI_SE=y # CONFIG_QCOM_GSBI is not set CONFIG_QCOM_LLCC=y CONFIG_QCOM_MDT_LOADER=y # CONFIG_QCOM_OCMEM is not set CONFIG_QCOM_QMI_HELPERS=m CONFIG_QCOM_RMTFS_MEM=m CONFIG_QCOM_RPMH=y CONFIG_QCOM_RPMHPD=y # CONFIG_QCOM_RPMPD is not set CONFIG_QCOM_SMEM=y CONFIG_QCOM_SMD_RPM=y CONFIG_QCOM_SMEM_STATE=y CONFIG_QCOM_SMP2P=y CONFIG_QCOM_SMSM=y CONFIG_QCOM_SOCINFO=y # CONFIG_QCOM_WCNSS_CTRL is not set # CONFIG_QCOM_APR is not set # end of Qualcomm SoC drivers # CONFIG_SOC_TI is not set # # Xilinx SoC drivers # # end of Xilinx SoC drivers # end of SOC (System On Chip) specific Drivers CONFIG_PM_DEVFREQ=y # # DEVFREQ Governors # CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y CONFIG_DEVFREQ_GOV_PERFORMANCE=y CONFIG_DEVFREQ_GOV_POWERSAVE=y CONFIG_DEVFREQ_GOV_USERSPACE=y # CONFIG_DEVFREQ_GOV_PASSIVE is not set # # DEVFREQ Drivers # CONFIG_PM_DEVFREQ_EVENT=y CONFIG_EXTCON=y # # Extcon Device Drivers # # CONFIG_EXTCON_ADC_JACK is not set # CONFIG_EXTCON_FSA9480 is not set # CONFIG_EXTCON_GPIO is not set # CONFIG_EXTCON_MAX3355 is not set # CONFIG_EXTCON_PTN5150 is not set # CONFIG_EXTCON_QCOM_SPMI_MISC is not set # CONFIG_EXTCON_RT8973A is not set # CONFIG_EXTCON_SM5502 is not set # CONFIG_EXTCON_USB_GPIO is not set CONFIG_EXTCON_USBC_CROS_EC=y # CONFIG_EXTCON_USBC_TUSB320 is not set CONFIG_MEMORY=y # CONFIG_ARM_PL172_MPMC is not set CONFIG_IIO=y CONFIG_IIO_BUFFER=y # CONFIG_IIO_BUFFER_CB is not set # CONFIG_IIO_BUFFER_DMA is not set # CONFIG_IIO_BUFFER_DMAENGINE is not set # CONFIG_IIO_BUFFER_HW_CONSUMER is not set CONFIG_IIO_KFIFO_BUF=y CONFIG_IIO_TRIGGERED_BUFFER=y # CONFIG_IIO_CONFIGFS is not set CONFIG_IIO_TRIGGER=y CONFIG_IIO_CONSUMERS_PER_TRIGGER=2 # CONFIG_IIO_SW_DEVICE is not set # CONFIG_IIO_SW_TRIGGER is not set # CONFIG_IIO_TRIGGERED_EVENT is not set # # Accelerometers # # CONFIG_ADIS16201 is not set # CONFIG_ADIS16209 is not set # CONFIG_ADXL345_I2C is not set # CONFIG_ADXL345_SPI is not set # CONFIG_ADXL372_SPI is not set # CONFIG_ADXL372_I2C is not set # CONFIG_BMA180 is not set # CONFIG_BMA220 is not set # CONFIG_BMA400 is not set # CONFIG_BMC150_ACCEL is not set # CONFIG_BMI088_ACCEL is not set # CONFIG_DA280 is not set # CONFIG_DA311 is not set # CONFIG_DMARD06 is not set # CONFIG_DMARD09 is not set # CONFIG_DMARD10 is not set # CONFIG_FXLS8962AF_I2C is not set # CONFIG_FXLS8962AF_SPI is not set # CONFIG_IIO_ST_ACCEL_3AXIS is not set # CONFIG_KXSD9 is not set # CONFIG_KXCJK1013 is not set # CONFIG_MC3230 is not set # CONFIG_MMA7455_I2C is not set # CONFIG_MMA7455_SPI is not set # CONFIG_MMA7660 is not set # CONFIG_MMA8452 is not set # CONFIG_MMA9551 is not set # CONFIG_MMA9553 is not set # CONFIG_MXC4005 is not set # CONFIG_MXC6255 is not set # CONFIG_SCA3000 is not set # CONFIG_SCA3300 is not set # CONFIG_STK8312 is not set # CONFIG_STK8BA50 is not set # end of Accelerometers # # Analog to digital converters # # CONFIG_AD7091R5 is not set # CONFIG_AD7124 is not set # CONFIG_AD7192 is not set # CONFIG_AD7266 is not set # CONFIG_AD7291 is not set # CONFIG_AD7292 is not set # CONFIG_AD7298 is not set # CONFIG_AD7476 is not set # CONFIG_AD7606_IFACE_PARALLEL is not set # CONFIG_AD7606_IFACE_SPI is not set # CONFIG_AD7766 is not set # CONFIG_AD7768_1 is not set # CONFIG_AD7780 is not set # CONFIG_AD7791 is not set # CONFIG_AD7793 is not set # CONFIG_AD7887 is not set # CONFIG_AD7923 is not set # CONFIG_AD7949 is not set # CONFIG_AD799X is not set # CONFIG_ADI_AXI_ADC is not set # CONFIG_CC10001_ADC is not set # CONFIG_ENVELOPE_DETECTOR is not set # CONFIG_HI8435 is not set # CONFIG_HX711 is not set # CONFIG_INA2XX_ADC is not set # CONFIG_LTC2471 is not set # CONFIG_LTC2485 is not set # CONFIG_LTC2496 is not set # CONFIG_LTC2497 is not set # CONFIG_MAX1027 is not set # CONFIG_MAX11100 is not set # CONFIG_MAX1118 is not set # CONFIG_MAX1241 is not set # CONFIG_MAX1363 is not set # CONFIG_MAX9611 is not set # CONFIG_MCP320X is not set # CONFIG_MCP3422 is not set # CONFIG_MCP3911 is not set # CONFIG_NAU7802 is not set CONFIG_QCOM_VADC_COMMON=y # CONFIG_QCOM_SPMI_IADC is not set # CONFIG_QCOM_SPMI_VADC is not set CONFIG_QCOM_SPMI_ADC5=y # CONFIG_SD_ADC_MODULATOR is not set # CONFIG_TI_ADC081C is not set # CONFIG_TI_ADC0832 is not set # CONFIG_TI_ADC084S021 is not set # CONFIG_TI_ADC12138 is not set # CONFIG_TI_ADC108S102 is not set # CONFIG_TI_ADC128S052 is not set # CONFIG_TI_ADC161S626 is not set # CONFIG_TI_ADS1015 is not set # CONFIG_TI_ADS7950 is not set # CONFIG_TI_ADS8344 is not set # CONFIG_TI_ADS8688 is not set # CONFIG_TI_ADS124S08 is not set # CONFIG_TI_ADS131E08 is not set # CONFIG_TI_TLC4541 is not set # CONFIG_TI_TSC2046 is not set # CONFIG_VF610_ADC is not set # CONFIG_XILINX_XADC is not set # end of Analog to digital converters # # Analog Front Ends # # CONFIG_IIO_RESCALE is not set # end of Analog Front Ends # # Amplifiers # # CONFIG_AD8366 is not set # CONFIG_HMC425 is not set # end of Amplifiers # # Capacitance to digital converters # # CONFIG_AD7150 is not set # end of Capacitance to digital converters # # Chemical Sensors # # CONFIG_ATLAS_PH_SENSOR is not set # CONFIG_ATLAS_EZO_SENSOR is not set # CONFIG_BME680 is not set # CONFIG_CCS811 is not set # CONFIG_IAQCORE is not set # CONFIG_PMS7003 is not set # CONFIG_SCD30_CORE is not set # CONFIG_SENSIRION_SGP30 is not set # CONFIG_SPS30_I2C is not set # CONFIG_SPS30_SERIAL is not set # CONFIG_VZ89X is not set # end of Chemical Sensors # CONFIG_IIO_CROS_EC_SENSORS_CORE is not set # # Hid Sensor IIO Common # # end of Hid Sensor IIO Common # # IIO SCMI Sensors # # end of IIO SCMI Sensors # # SSP Sensor Common # # CONFIG_IIO_SSP_SENSORHUB is not set # end of SSP Sensor Common # # Digital to analog converters # # CONFIG_AD5064 is not set # CONFIG_AD5360 is not set # CONFIG_AD5380 is not set # CONFIG_AD5421 is not set # CONFIG_AD5446 is not set # CONFIG_AD5449 is not set # CONFIG_AD5592R is not set # CONFIG_AD5593R is not set # CONFIG_AD5504 is not set # CONFIG_AD5624R_SPI is not set # CONFIG_AD5686_SPI is not set # CONFIG_AD5696_I2C is not set # CONFIG_AD5755 is not set # CONFIG_AD5758 is not set # CONFIG_AD5761 is not set # CONFIG_AD5764 is not set # CONFIG_AD5766 is not set # CONFIG_AD5770R is not set # CONFIG_AD5791 is not set # CONFIG_AD7303 is not set # CONFIG_AD8801 is not set # CONFIG_DPOT_DAC is not set # CONFIG_DS4424 is not set # CONFIG_LTC1660 is not set # CONFIG_LTC2632 is not set # CONFIG_M62332 is not set # CONFIG_MAX517 is not set # CONFIG_MAX5821 is not set # CONFIG_MCP4725 is not set # CONFIG_MCP4922 is not set # CONFIG_TI_DAC082S085 is not set # CONFIG_TI_DAC5571 is not set # CONFIG_TI_DAC7311 is not set # CONFIG_TI_DAC7612 is not set # CONFIG_VF610_DAC is not set # end of Digital to analog converters # # IIO dummy driver # # end of IIO dummy driver # # Frequency Synthesizers DDS/PLL # # # Clock Generator/Distribution # # CONFIG_AD9523 is not set # end of Clock Generator/Distribution # # Phase-Locked Loop (PLL) frequency synthesizers # # CONFIG_ADF4350 is not set # CONFIG_ADF4371 is not set # end of Phase-Locked Loop (PLL) frequency synthesizers # end of Frequency Synthesizers DDS/PLL # # Digital gyroscope sensors # # CONFIG_ADIS16080 is not set # CONFIG_ADIS16130 is not set # CONFIG_ADIS16136 is not set # CONFIG_ADIS16260 is not set # CONFIG_ADXRS290 is not set # CONFIG_ADXRS450 is not set # CONFIG_BMG160 is not set # CONFIG_FXAS21002C is not set # CONFIG_MPU3050_I2C is not set # CONFIG_IIO_ST_GYRO_3AXIS is not set # CONFIG_ITG3200 is not set # end of Digital gyroscope sensors # # Health Sensors # # # Heart Rate Monitors # # CONFIG_AFE4403 is not set # CONFIG_AFE4404 is not set # CONFIG_MAX30100 is not set # CONFIG_MAX30102 is not set # end of Heart Rate Monitors # end of Health Sensors # # Humidity sensors # # CONFIG_AM2315 is not set # CONFIG_DHT11 is not set # CONFIG_HDC100X is not set # CONFIG_HDC2010 is not set # CONFIG_HTS221 is not set # CONFIG_HTU21 is not set # CONFIG_SI7005 is not set # CONFIG_SI7020 is not set # end of Humidity sensors # # Inertial measurement units # # CONFIG_ADIS16400 is not set # CONFIG_ADIS16460 is not set # CONFIG_ADIS16475 is not set # CONFIG_ADIS16480 is not set # CONFIG_BMI160_I2C is not set # CONFIG_BMI160_SPI is not set # CONFIG_FXOS8700_I2C is not set # CONFIG_FXOS8700_SPI is not set # CONFIG_KMX61 is not set # CONFIG_INV_ICM42600_I2C is not set # CONFIG_INV_ICM42600_SPI is not set # CONFIG_INV_MPU6050_I2C is not set # CONFIG_INV_MPU6050_SPI is not set # CONFIG_IIO_ST_LSM6DSX is not set # CONFIG_IIO_ST_LSM9DS0 is not set # end of Inertial measurement units # # Light sensors # # CONFIG_ADJD_S311 is not set # CONFIG_ADUX1020 is not set # CONFIG_AL3010 is not set # CONFIG_AL3320A is not set # CONFIG_APDS9300 is not set # CONFIG_APDS9960 is not set # CONFIG_AS73211 is not set # CONFIG_BH1750 is not set # CONFIG_BH1780 is not set # CONFIG_CM32181 is not set # CONFIG_CM3232 is not set # CONFIG_CM3323 is not set # CONFIG_CM3605 is not set # CONFIG_CM36651 is not set # CONFIG_GP2AP002 is not set # CONFIG_GP2AP020A00F is not set CONFIG_SENSORS_ISL29018=m # CONFIG_SENSORS_ISL29028 is not set # CONFIG_ISL29125 is not set # CONFIG_JSA1212 is not set # CONFIG_RPR0521 is not set # CONFIG_LTR501 is not set # CONFIG_LV0104CS is not set # CONFIG_MAX44000 is not set # CONFIG_MAX44009 is not set # CONFIG_NOA1305 is not set # CONFIG_OPT3001 is not set # CONFIG_PA12203001 is not set # CONFIG_SI1133 is not set # CONFIG_SI1145 is not set # CONFIG_STK3310 is not set # CONFIG_ST_UVIS25 is not set # CONFIG_TCS3414 is not set # CONFIG_TCS3472 is not set CONFIG_SENSORS_TSL2563=m CONFIG_TSL2583=m # CONFIG_TSL2591 is not set # CONFIG_TSL2772 is not set # CONFIG_TSL4531 is not set # CONFIG_US5182D is not set # CONFIG_VCNL4000 is not set # CONFIG_VCNL4035 is not set # CONFIG_VEML6030 is not set # CONFIG_VEML6070 is not set # CONFIG_VL6180 is not set # CONFIG_ZOPT2201 is not set # end of Light sensors # # Magnetometer sensors # # CONFIG_AK8974 is not set CONFIG_AK8975=m # CONFIG_AK09911 is not set # CONFIG_BMC150_MAGN_I2C is not set # CONFIG_BMC150_MAGN_SPI is not set # CONFIG_MAG3110 is not set # CONFIG_MMC35240 is not set # CONFIG_IIO_ST_MAGN_3AXIS is not set # CONFIG_SENSORS_HMC5843_I2C is not set # CONFIG_SENSORS_HMC5843_SPI is not set # CONFIG_SENSORS_RM3100_I2C is not set # CONFIG_SENSORS_RM3100_SPI is not set # CONFIG_YAMAHA_YAS530 is not set # end of Magnetometer sensors # # Multiplexers # # CONFIG_IIO_MUX is not set # end of Multiplexers # # Inclinometer sensors # # end of Inclinometer sensors # # Triggers - standalone # # CONFIG_IIO_INTERRUPT_TRIGGER is not set CONFIG_IIO_SYSFS_TRIGGER=y # end of Triggers - standalone # # Linear and angular position sensors # # end of Linear and angular position sensors # # Digital potentiometers # # CONFIG_AD5272 is not set # CONFIG_DS1803 is not set # CONFIG_MAX5432 is not set # CONFIG_MAX5481 is not set # CONFIG_MAX5487 is not set # CONFIG_MCP4018 is not set # CONFIG_MCP4131 is not set # CONFIG_MCP4531 is not set # CONFIG_MCP41010 is not set # CONFIG_TPL0102 is not set # end of Digital potentiometers # # Digital potentiostats # # CONFIG_LMP91000 is not set # end of Digital potentiostats # # Pressure sensors # # CONFIG_ABP060MG is not set # CONFIG_BMP280 is not set # CONFIG_DLHL60D is not set # CONFIG_DPS310 is not set # CONFIG_HP03 is not set # CONFIG_ICP10100 is not set # CONFIG_MPL115_I2C is not set # CONFIG_MPL115_SPI is not set # CONFIG_MPL3115 is not set # CONFIG_MS5611 is not set # CONFIG_MS5637 is not set # CONFIG_IIO_ST_PRESS is not set # CONFIG_T5403 is not set # CONFIG_HP206C is not set # CONFIG_ZPA2326 is not set # end of Pressure sensors # # Lightning sensors # # CONFIG_AS3935 is not set # end of Lightning sensors # # Proximity and distance sensors # # CONFIG_CROS_EC_MKBP_PROXIMITY is not set # CONFIG_ISL29501 is not set # CONFIG_LIDAR_LITE_V2 is not set # CONFIG_MB1232 is not set # CONFIG_PING is not set # CONFIG_RFD77402 is not set # CONFIG_SRF04 is not set CONFIG_SX9310=y # CONFIG_SX9500 is not set # CONFIG_SRF08 is not set # CONFIG_VCNL3020 is not set # CONFIG_VL53L0X_I2C is not set # end of Proximity and distance sensors # # Resolver to digital converters # # CONFIG_AD2S90 is not set # CONFIG_AD2S1200 is not set # end of Resolver to digital converters # # Temperature sensors # # CONFIG_LTC2983 is not set # CONFIG_MAXIM_THERMOCOUPLE is not set # CONFIG_MLX90614 is not set # CONFIG_MLX90632 is not set # CONFIG_TMP006 is not set # CONFIG_TMP007 is not set # CONFIG_TMP117 is not set # CONFIG_TSYS01 is not set # CONFIG_TSYS02D is not set # CONFIG_MAX31856 is not set # end of Temperature sensors CONFIG_PWM=y CONFIG_PWM_SYSFS=y # CONFIG_PWM_DEBUG is not set # CONFIG_PWM_ATMEL_TCB is not set CONFIG_PWM_CROS_EC=y # CONFIG_PWM_FSL_FTM is not set # CONFIG_PWM_PCA9685 is not set # # IRQ chip support # CONFIG_IRQCHIP=y CONFIG_ARM_GIC=y CONFIG_ARM_GIC_MAX_NR=1 CONFIG_ARM_GIC_V3=y CONFIG_ARM_GIC_V3_ITS=y # CONFIG_AL_FIC is not set CONFIG_PARTITION_PERCPU=y CONFIG_QCOM_PDC=y # end of IRQ chip support # CONFIG_IPACK_BUS is not set CONFIG_RESET_CONTROLLER=y CONFIG_RESET_QCOM_AOSS=y CONFIG_RESET_QCOM_PDC=y # CONFIG_RESET_TI_SYSCON is not set # # PHY Subsystem # CONFIG_GENERIC_PHY=y # CONFIG_PHY_XGENE is not set # CONFIG_PHY_CAN_TRANSCEIVER is not set # CONFIG_BCM_KONA_USB2_PHY is not set # CONFIG_PHY_CADENCE_TORRENT is not set # CONFIG_PHY_CADENCE_DPHY is not set # CONFIG_PHY_CADENCE_SIERRA is not set # CONFIG_PHY_CADENCE_SALVO is not set # CONFIG_PHY_FSL_IMX8MQ_USB is not set # CONFIG_PHY_MIXEL_MIPI_DPHY is not set # CONFIG_PHY_PXA_28NM_HSIC is not set # CONFIG_PHY_PXA_28NM_USB2 is not set # CONFIG_PHY_CPCAP_USB is not set # CONFIG_PHY_MAPPHONE_MDM6600 is not set # CONFIG_PHY_OCELOT_SERDES is not set # CONFIG_PHY_QCOM_APQ8064_SATA is not set # CONFIG_PHY_QCOM_IPQ4019_USB is not set # CONFIG_PHY_QCOM_IPQ806X_SATA is not set # CONFIG_PHY_QCOM_PCIE2 is not set CONFIG_PHY_QCOM_QMP=y CONFIG_PHY_QCOM_QUSB2=y # CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2 is not set # CONFIG_PHY_QCOM_USB_HS_28NM is not set # CONFIG_PHY_QCOM_USB_SS is not set # CONFIG_PHY_QCOM_IPQ806X_USB is not set # end of PHY Subsystem # CONFIG_POWERCAP is not set # CONFIG_MCB is not set # # Performance monitor support # # CONFIG_ARM_CCI_PMU is not set # CONFIG_ARM_CCN is not set # CONFIG_ARM_CMN is not set CONFIG_ARM_PMU=y # CONFIG_ARM_DSU_PMU is not set # CONFIG_ARM_SPE_PMU is not set # end of Performance monitor support CONFIG_RAS=y # # Android # CONFIG_ANDROID=y CONFIG_ANDROID_BINDER_IPC=y # CONFIG_ANDROID_BINDERFS is not set CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder" # CONFIG_ANDROID_BINDER_IPC_SELFTEST is not set # end of Android # CONFIG_LIBNVDIMM is not set CONFIG_DAX=y # CONFIG_DEV_DAX is not set CONFIG_NVMEM=y CONFIG_NVMEM_SYSFS=y CONFIG_QCOM_QFPROM=y # CONFIG_NVMEM_SPMI_SDAM is not set # CONFIG_NVMEM_RMEM is not set # # HW tracing support # # CONFIG_STM is not set # CONFIG_INTEL_TH is not set # end of HW tracing support # CONFIG_FPGA is not set # CONFIG_FSI is not set # CONFIG_TEE is not set CONFIG_PM_OPP=y # CONFIG_SIOX is not set # CONFIG_SLIMBUS is not set CONFIG_INTERCONNECT=y CONFIG_INTERCONNECT_QCOM=y CONFIG_INTERCONNECT_QCOM_BCM_VOTER=y # CONFIG_INTERCONNECT_QCOM_MSM8916 is not set # CONFIG_INTERCONNECT_QCOM_MSM8939 is not set # CONFIG_INTERCONNECT_QCOM_MSM8974 is not set CONFIG_INTERCONNECT_QCOM_OSM_L3=y # CONFIG_INTERCONNECT_QCOM_QCS404 is not set CONFIG_INTERCONNECT_QCOM_RPMH_POSSIBLE=y CONFIG_INTERCONNECT_QCOM_RPMH=y CONFIG_INTERCONNECT_QCOM_SC7180=y # CONFIG_INTERCONNECT_QCOM_SC7280 is not set # CONFIG_INTERCONNECT_QCOM_SDM660 is not set CONFIG_INTERCONNECT_QCOM_SDM845=y # CONFIG_INTERCONNECT_QCOM_SDX55 is not set # CONFIG_INTERCONNECT_QCOM_SM8150 is not set # CONFIG_INTERCONNECT_QCOM_SM8250 is not set # CONFIG_INTERCONNECT_QCOM_SM8350 is not set CONFIG_COUNTER=y # CONFIG_INTERRUPT_CNT is not set # CONFIG_FTM_QUADDEC is not set # CONFIG_MICROCHIP_TCB_CAPTURE is not set # CONFIG_MOST is not set # end of Device Drivers # # File systems # CONFIG_DCACHE_WORD_ACCESS=y # CONFIG_VALIDATE_FS_PARSER is not set CONFIG_FS_IOMAP=y # CONFIG_EXT2_FS is not set # CONFIG_EXT3_FS is not set CONFIG_EXT4_FS=y CONFIG_EXT4_USE_FOR_EXT2=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_JBD2=y # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=y # CONFIG_REISERFS_FS is not set # CONFIG_JFS_FS is not set # CONFIG_XFS_FS is not set # CONFIG_GFS2_FS is not set # CONFIG_OCFS2_FS is not set # CONFIG_BTRFS_FS is not set # CONFIG_NILFS2_FS is not set # CONFIG_F2FS_FS is not set # CONFIG_FS_DAX is not set CONFIG_FS_POSIX_ACL=y CONFIG_EXPORTFS=y # CONFIG_EXPORTFS_BLOCK_OPS is not set CONFIG_FILE_LOCKING=y CONFIG_MANDATORY_FILE_LOCKING=y CONFIG_FS_ENCRYPTION=y CONFIG_FS_ENCRYPTION_ALGS=y # CONFIG_FS_VERITY is not set CONFIG_FSNOTIFY=y # CONFIG_DNOTIFY is not set CONFIG_INOTIFY_USER=y CONFIG_FANOTIFY=y # CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set CONFIG_QUOTA=y # CONFIG_QUOTA_NETLINK_INTERFACE is not set CONFIG_PRINT_QUOTA_WARNING=y # CONFIG_QUOTA_DEBUG is not set CONFIG_QUOTA_TREE=y # CONFIG_QFMT_V1 is not set CONFIG_QFMT_V2=y CONFIG_QUOTACTL=y # CONFIG_AUTOFS4_FS is not set # CONFIG_AUTOFS_FS is not set CONFIG_FUSE_FS=m # CONFIG_CUSE is not set # CONFIG_VIRTIO_FS is not set # CONFIG_OVERLAY_FS is not set # # Caches # # CONFIG_FSCACHE is not set # end of Caches # # CD-ROM/DVD Filesystems # CONFIG_ISO9660_FS=m CONFIG_JOLIET=y CONFIG_ZISOFS=y CONFIG_UDF_FS=m # end of CD-ROM/DVD Filesystems # # DOS/FAT/EXFAT/NT Filesystems # CONFIG_FAT_FS=m # CONFIG_MSDOS_FS is not set CONFIG_VFAT_FS=m CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" # CONFIG_FAT_DEFAULT_UTF8 is not set # CONFIG_EXFAT_FS is not set # CONFIG_NTFS_FS is not set # end of DOS/FAT/EXFAT/NT Filesystems # # Pseudo filesystems # CONFIG_PROC_FS=y # CONFIG_PROC_KCORE is not set CONFIG_PROC_SYSCTL=y CONFIG_PROC_PAGE_MONITOR=y CONFIG_PROC_CHILDREN=y CONFIG_KERNFS=y CONFIG_SYSFS=y CONFIG_TMPFS=y CONFIG_TMPFS_POSIX_ACL=y CONFIG_TMPFS_XATTR=y # CONFIG_TMPFS_INODE64 is not set CONFIG_ARCH_SUPPORTS_HUGETLBFS=y # CONFIG_HUGETLBFS is not set CONFIG_MEMFD_CREATE=y CONFIG_ARCH_HAS_GIGANTIC_PAGE=y CONFIG_CONFIGFS_FS=y # end of Pseudo filesystems CONFIG_MISC_FILESYSTEMS=y # CONFIG_ORANGEFS_FS is not set # CONFIG_ADFS_FS is not set # CONFIG_AFFS_FS is not set CONFIG_ECRYPT_FS=y # CONFIG_ECRYPT_FS_MESSAGING is not set # CONFIG_HFS_FS is not set CONFIG_HFSPLUS_FS=m # CONFIG_BEFS_FS is not set # CONFIG_BFS_FS is not set # CONFIG_EFS_FS is not set # CONFIG_JFFS2_FS is not set # CONFIG_CRAMFS is not set CONFIG_SQUASHFS=y # CONFIG_SQUASHFS_FILE_CACHE is not set CONFIG_SQUASHFS_FILE_DIRECT=y CONFIG_SQUASHFS_DECOMP_SINGLE=y # CONFIG_SQUASHFS_DECOMP_MULTI is not set # CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set CONFIG_SQUASHFS_XATTR=y CONFIG_SQUASHFS_ZLIB=y CONFIG_SQUASHFS_LZ4=y CONFIG_SQUASHFS_LZO=y # CONFIG_SQUASHFS_XZ is not set # CONFIG_SQUASHFS_ZSTD is not set CONFIG_SQUASHFS_4K_DEVBLK_SIZE=y # CONFIG_SQUASHFS_EMBEDDED is not set CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 # CONFIG_VXFS_FS is not set # CONFIG_MINIX_FS is not set # CONFIG_OMFS_FS is not set # CONFIG_HPFS_FS is not set # CONFIG_QNX4FS_FS is not set # CONFIG_QNX6FS_FS is not set # CONFIG_ROMFS_FS is not set CONFIG_PSTORE=y CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240 CONFIG_PSTORE_DEFLATE_COMPRESS=y # CONFIG_PSTORE_LZO_COMPRESS is not set # CONFIG_PSTORE_LZ4_COMPRESS is not set # CONFIG_PSTORE_LZ4HC_COMPRESS is not set # CONFIG_PSTORE_842_COMPRESS is not set # CONFIG_PSTORE_ZSTD_COMPRESS is not set CONFIG_PSTORE_COMPRESS=y CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" CONFIG_PSTORE_CONSOLE=y CONFIG_PSTORE_PMSG=y # CONFIG_PSTORE_FTRACE is not set CONFIG_PSTORE_RAM=y # CONFIG_SYSV_FS is not set # CONFIG_UFS_FS is not set # CONFIG_EROFS_FS is not set CONFIG_NETWORK_FILESYSTEMS=y CONFIG_NFS_FS=m CONFIG_NFS_V2=m CONFIG_NFS_V3=m # CONFIG_NFS_V3_ACL is not set CONFIG_NFS_V4=m # CONFIG_NFS_SWAP is not set # CONFIG_NFS_V4_1 is not set # CONFIG_NFS_USE_LEGACY_DNS is not set CONFIG_NFS_USE_KERNEL_DNS=y CONFIG_NFS_DISABLE_UDP_SUPPORT=y # CONFIG_NFSD is not set CONFIG_GRACE_PERIOD=m CONFIG_LOCKD=m CONFIG_LOCKD_V4=y CONFIG_NFS_COMMON=y CONFIG_SUNRPC=m CONFIG_SUNRPC_GSS=m # CONFIG_SUNRPC_DEBUG is not set # CONFIG_CEPH_FS is not set # CONFIG_CIFS is not set # CONFIG_CODA_FS is not set # CONFIG_AFS_FS is not set CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf8" CONFIG_NLS_CODEPAGE_437=m # CONFIG_NLS_CODEPAGE_737 is not set # CONFIG_NLS_CODEPAGE_775 is not set # CONFIG_NLS_CODEPAGE_850 is not set # CONFIG_NLS_CODEPAGE_852 is not set # CONFIG_NLS_CODEPAGE_855 is not set # CONFIG_NLS_CODEPAGE_857 is not set # CONFIG_NLS_CODEPAGE_860 is not set # CONFIG_NLS_CODEPAGE_861 is not set # CONFIG_NLS_CODEPAGE_862 is not set # CONFIG_NLS_CODEPAGE_863 is not set # CONFIG_NLS_CODEPAGE_864 is not set # CONFIG_NLS_CODEPAGE_865 is not set # CONFIG_NLS_CODEPAGE_866 is not set # CONFIG_NLS_CODEPAGE_869 is not set # CONFIG_NLS_CODEPAGE_936 is not set # CONFIG_NLS_CODEPAGE_950 is not set # CONFIG_NLS_CODEPAGE_932 is not set # CONFIG_NLS_CODEPAGE_949 is not set # CONFIG_NLS_CODEPAGE_874 is not set # CONFIG_NLS_ISO8859_8 is not set # CONFIG_NLS_CODEPAGE_1250 is not set # CONFIG_NLS_CODEPAGE_1251 is not set CONFIG_NLS_ASCII=m CONFIG_NLS_ISO8859_1=m # CONFIG_NLS_ISO8859_2 is not set # CONFIG_NLS_ISO8859_3 is not set # CONFIG_NLS_ISO8859_4 is not set # CONFIG_NLS_ISO8859_5 is not set # CONFIG_NLS_ISO8859_6 is not set # CONFIG_NLS_ISO8859_7 is not set # CONFIG_NLS_ISO8859_9 is not set # CONFIG_NLS_ISO8859_13 is not set # CONFIG_NLS_ISO8859_14 is not set # CONFIG_NLS_ISO8859_15 is not set # CONFIG_NLS_KOI8_R is not set # CONFIG_NLS_KOI8_U is not set # CONFIG_NLS_MAC_ROMAN is not set # CONFIG_NLS_MAC_CELTIC is not set # CONFIG_NLS_MAC_CENTEURO is not set # CONFIG_NLS_MAC_CROATIAN is not set # CONFIG_NLS_MAC_CYRILLIC is not set # CONFIG_NLS_MAC_GAELIC is not set # CONFIG_NLS_MAC_GREEK is not set # CONFIG_NLS_MAC_ICELAND is not set # CONFIG_NLS_MAC_INUIT is not set # CONFIG_NLS_MAC_ROMANIAN is not set # CONFIG_NLS_MAC_TURKISH is not set CONFIG_NLS_UTF8=m # CONFIG_DLM is not set # CONFIG_UNICODE is not set CONFIG_IO_WQ=y # end of File systems # # Security options # CONFIG_KEYS=y # CONFIG_KEYS_REQUEST_CACHE is not set # CONFIG_PERSISTENT_KEYRINGS is not set # CONFIG_TRUSTED_KEYS is not set CONFIG_ENCRYPTED_KEYS=y # CONFIG_KEY_DH_OPERATIONS is not set # CONFIG_SECURITY_DMESG_RESTRICT is not set CONFIG_SECURITY=y CONFIG_SECURITYFS=y CONFIG_SECURITY_NETWORK=y # CONFIG_SECURITY_NETWORK_XFRM is not set CONFIG_SECURITY_PATH=y CONFIG_LSM_MMAP_MIN_ADDR=32768 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y CONFIG_HARDENED_USERCOPY=y CONFIG_HARDENED_USERCOPY_FALLBACK=y CONFIG_HARDENED_USERCOPY_PAGESPAN=y # CONFIG_FORTIFY_SOURCE is not set CONFIG_STATIC_USERMODEHELPER=y CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/usermode-helper" CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y # CONFIG_SECURITY_SELINUX_DISABLE is not set CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0 CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9 CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256 # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set CONFIG_SECURITY_LOADPIN=y # CONFIG_SECURITY_LOADPIN_ENFORCE is not set CONFIG_SECURITY_YAMA=y CONFIG_SECURITY_SAFESETID=y # CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_SECURITY_LANDLOCK is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set CONFIG_INTEGRITY_AUDIT=y # CONFIG_IMA is not set # CONFIG_EVM is not set CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_DAC is not set CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" # # Kernel hardening options # # # Memory initialization # CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y # CONFIG_INIT_STACK_NONE is not set CONFIG_INIT_STACK_ALL_PATTERN=y # CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set # end of Memory initialization # end of Kernel hardening options # end of Security options CONFIG_CRYPTO=y # # Crypto core or helper # CONFIG_CRYPTO_ALGAPI=y CONFIG_CRYPTO_ALGAPI2=y CONFIG_CRYPTO_AEAD=y CONFIG_CRYPTO_AEAD2=y CONFIG_CRYPTO_SKCIPHER=y CONFIG_CRYPTO_SKCIPHER2=y CONFIG_CRYPTO_HASH=y CONFIG_CRYPTO_HASH2=y CONFIG_CRYPTO_RNG=y CONFIG_CRYPTO_RNG2=y CONFIG_CRYPTO_RNG_DEFAULT=y CONFIG_CRYPTO_AKCIPHER2=y CONFIG_CRYPTO_KPP2=y CONFIG_CRYPTO_KPP=m CONFIG_CRYPTO_ACOMP2=y CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y # CONFIG_CRYPTO_USER is not set CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y CONFIG_CRYPTO_GF128MUL=y CONFIG_CRYPTO_NULL=y CONFIG_CRYPTO_NULL2=y # CONFIG_CRYPTO_PCRYPT is not set CONFIG_CRYPTO_CRYPTD=y CONFIG_CRYPTO_AUTHENC=y # CONFIG_CRYPTO_TEST is not set CONFIG_CRYPTO_SIMD=y # # Public-key cryptography # # CONFIG_CRYPTO_RSA is not set # CONFIG_CRYPTO_DH is not set CONFIG_CRYPTO_ECC=m CONFIG_CRYPTO_ECDH=m # CONFIG_CRYPTO_ECDSA is not set # CONFIG_CRYPTO_ECRDSA is not set # CONFIG_CRYPTO_SM2 is not set # CONFIG_CRYPTO_CURVE25519 is not set # # Authenticated Encryption with Associated Data # CONFIG_CRYPTO_CCM=m CONFIG_CRYPTO_GCM=y # CONFIG_CRYPTO_CHACHA20POLY1305 is not set # CONFIG_CRYPTO_AEGIS128 is not set CONFIG_CRYPTO_SEQIV=y CONFIG_CRYPTO_ECHAINIV=y # # Block modes # CONFIG_CRYPTO_CBC=y # CONFIG_CRYPTO_CFB is not set CONFIG_CRYPTO_CTR=y CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_ECB=y # CONFIG_CRYPTO_LRW is not set # CONFIG_CRYPTO_OFB is not set # CONFIG_CRYPTO_PCBC is not set CONFIG_CRYPTO_XTS=y # CONFIG_CRYPTO_KEYWRAP is not set # CONFIG_CRYPTO_ADIANTUM is not set CONFIG_CRYPTO_ESSIV=y # # Hash modes # CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_HMAC=y # CONFIG_CRYPTO_XCBC is not set # CONFIG_CRYPTO_VMAC is not set # # Digest # CONFIG_CRYPTO_CRC32C=y # CONFIG_CRYPTO_CRC32 is not set # CONFIG_CRYPTO_XXHASH is not set # CONFIG_CRYPTO_BLAKE2B is not set # CONFIG_CRYPTO_BLAKE2S is not set CONFIG_CRYPTO_CRCT10DIF=m CONFIG_CRYPTO_GHASH=y # CONFIG_CRYPTO_POLY1305 is not set # CONFIG_CRYPTO_MD4 is not set CONFIG_CRYPTO_MD5=y CONFIG_CRYPTO_MICHAEL_MIC=m # CONFIG_CRYPTO_RMD160 is not set CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y # CONFIG_CRYPTO_SHA3 is not set # CONFIG_CRYPTO_SM3 is not set # CONFIG_CRYPTO_STREEBOG is not set # CONFIG_CRYPTO_WP512 is not set # # Ciphers # CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_AES_TI is not set # CONFIG_CRYPTO_ANUBIS is not set CONFIG_CRYPTO_ARC4=y # CONFIG_CRYPTO_BLOWFISH is not set # CONFIG_CRYPTO_CAMELLIA is not set # CONFIG_CRYPTO_CAST5 is not set # CONFIG_CRYPTO_CAST6 is not set # CONFIG_CRYPTO_DES is not set # CONFIG_CRYPTO_FCRYPT is not set # CONFIG_CRYPTO_KHAZAD is not set # CONFIG_CRYPTO_CHACHA20 is not set # CONFIG_CRYPTO_SEED is not set # CONFIG_CRYPTO_SERPENT is not set # CONFIG_CRYPTO_SM4 is not set # CONFIG_CRYPTO_TEA is not set # CONFIG_CRYPTO_TWOFISH is not set # # Compression # CONFIG_CRYPTO_DEFLATE=y CONFIG_CRYPTO_LZO=m # CONFIG_CRYPTO_842 is not set # CONFIG_CRYPTO_LZ4 is not set # CONFIG_CRYPTO_LZ4HC is not set # CONFIG_CRYPTO_ZSTD is not set # # Random Number Generation # # CONFIG_CRYPTO_ANSI_CPRNG is not set CONFIG_CRYPTO_DRBG_MENU=y CONFIG_CRYPTO_DRBG_HMAC=y # CONFIG_CRYPTO_DRBG_HASH is not set # CONFIG_CRYPTO_DRBG_CTR is not set CONFIG_CRYPTO_DRBG=y CONFIG_CRYPTO_JITTERENTROPY=y CONFIG_CRYPTO_USER_API=m CONFIG_CRYPTO_USER_API_HASH=m CONFIG_CRYPTO_USER_API_SKCIPHER=m # CONFIG_CRYPTO_USER_API_RNG is not set # CONFIG_CRYPTO_USER_API_AEAD is not set CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y CONFIG_CRYPTO_HASH_INFO=y # # Crypto library routines # CONFIG_CRYPTO_LIB_AES=y CONFIG_CRYPTO_LIB_ARC4=y # CONFIG_CRYPTO_LIB_BLAKE2S is not set # CONFIG_CRYPTO_LIB_CHACHA is not set # CONFIG_CRYPTO_LIB_CURVE25519 is not set CONFIG_CRYPTO_LIB_POLY1305_RSIZE=9 # CONFIG_CRYPTO_LIB_POLY1305 is not set # CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set CONFIG_CRYPTO_LIB_SHA256=y CONFIG_CRYPTO_HW=y # CONFIG_CRYPTO_DEV_ATMEL_ECC is not set # CONFIG_CRYPTO_DEV_ATMEL_SHA204A is not set # CONFIG_CRYPTO_DEV_CCP is not set # CONFIG_CRYPTO_DEV_QCE is not set # CONFIG_CRYPTO_DEV_QCOM_RNG is not set # CONFIG_CRYPTO_DEV_VIRTIO is not set # CONFIG_CRYPTO_DEV_SAFEXCEL is not set # CONFIG_CRYPTO_DEV_CCREE is not set # CONFIG_CRYPTO_DEV_HISI_SEC is not set # CONFIG_CRYPTO_DEV_AMLOGIC_GXL is not set # CONFIG_ASYMMETRIC_KEY_TYPE is not set # # Certificates for signature checking # # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set # end of Certificates for signature checking CONFIG_BINARY_PRINTF=y # # Library routines # CONFIG_LINEAR_RANGES=y # CONFIG_PACKING is not set CONFIG_BITREVERSE=y CONFIG_HAVE_ARCH_BITREVERSE=y CONFIG_GENERIC_STRNCPY_FROM_USER=y CONFIG_GENERIC_STRNLEN_USER=y CONFIG_GENERIC_NET_UTILS=y CONFIG_GENERIC_FIND_FIRST_BIT=y # CONFIG_CORDIC is not set # CONFIG_PRIME_NUMBERS is not set CONFIG_RATIONAL=y CONFIG_GENERIC_PCI_IOMAP=y CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y CONFIG_ARCH_HAS_FAST_MULTIPLIER=y CONFIG_ARCH_USE_SYM_ANNOTATIONS=y # CONFIG_INDIRECT_PIO is not set CONFIG_CRC_CCITT=y CONFIG_CRC16=y CONFIG_CRC_T10DIF=m CONFIG_CRC_ITU_T=y CONFIG_CRC32=y # CONFIG_CRC32_SELFTEST is not set CONFIG_CRC32_SLICEBY8=y # CONFIG_CRC32_SLICEBY4 is not set # CONFIG_CRC32_SARWATE is not set # CONFIG_CRC32_BIT is not set # CONFIG_CRC64 is not set # CONFIG_CRC4 is not set CONFIG_CRC7=m CONFIG_LIBCRC32C=y # CONFIG_CRC8 is not set CONFIG_XXHASH=y CONFIG_AUDIT_GENERIC=y CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y CONFIG_AUDIT_COMPAT_GENERIC=y # CONFIG_RANDOM32_SELFTEST is not set CONFIG_ZLIB_INFLATE=y CONFIG_ZLIB_DEFLATE=y CONFIG_LZO_COMPRESS=m CONFIG_LZO_DECOMPRESS=y CONFIG_LZ4_DECOMPRESS=y CONFIG_ZSTD_DECOMPRESS=y CONFIG_XZ_DEC=y # CONFIG_XZ_DEC_X86 is not set # CONFIG_XZ_DEC_POWERPC is not set # CONFIG_XZ_DEC_IA64 is not set # CONFIG_XZ_DEC_ARM is not set # CONFIG_XZ_DEC_ARMTHUMB is not set # CONFIG_XZ_DEC_SPARC is not set # CONFIG_XZ_DEC_TEST is not set CONFIG_DECOMPRESS_GZIP=y CONFIG_DECOMPRESS_XZ=y CONFIG_DECOMPRESS_ZSTD=y CONFIG_GENERIC_ALLOCATOR=y CONFIG_REED_SOLOMON=y CONFIG_REED_SOLOMON_ENC8=y CONFIG_REED_SOLOMON_DEC8=y CONFIG_TEXTSEARCH=y CONFIG_TEXTSEARCH_KMP=y CONFIG_TEXTSEARCH_BM=y CONFIG_TEXTSEARCH_FSM=y CONFIG_INTERVAL_TREE=y CONFIG_XARRAY_MULTI=y CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_DMA=y CONFIG_DMA_OPS=y CONFIG_NEED_SG_DMA_LENGTH=y CONFIG_NEED_DMA_MAP_STATE=y CONFIG_ARCH_DMA_ADDR_T_64BIT=y CONFIG_DMA_DECLARE_COHERENT=y CONFIG_ARCH_HAS_SETUP_DMA_OPS=y CONFIG_ARCH_HAS_TEARDOWN_DMA_OPS=y CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE=y CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU=y CONFIG_ARCH_HAS_DMA_PREP_COHERENT=y CONFIG_SWIOTLB=y CONFIG_DMA_NONCOHERENT_MMAP=y CONFIG_DMA_COHERENT_POOL=y CONFIG_DMA_REMAP=y CONFIG_DMA_DIRECT_REMAP=y CONFIG_DMA_API_DEBUG=y CONFIG_DMA_API_DEBUG_SG=y # CONFIG_DMA_MAP_BENCHMARK is not set CONFIG_SGL_ALLOC=y # CONFIG_CPUMASK_OFFSTACK is not set CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_GLOB=y # CONFIG_GLOB_SELFTEST is not set CONFIG_NLATTR=y # CONFIG_IRQ_POLL is not set CONFIG_LIBFDT=y CONFIG_OID_REGISTRY=m CONFIG_HAVE_GENERIC_VDSO=y CONFIG_GENERIC_GETTIMEOFDAY=y CONFIG_GENERIC_COMPAT_VDSO=y CONFIG_GENERIC_VDSO_TIME_NS=y CONFIG_SG_POOL=y CONFIG_ARCH_STACKWALK=y CONFIG_STACKDEPOT=y CONFIG_STACK_HASH_ORDER=20 CONFIG_SBITMAP=y # end of Library routines CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y # # Kernel hacking # # # printk and dmesg options # CONFIG_PRINTK_TIME=y # CONFIG_PRINTK_CALLER is not set # CONFIG_STACKTRACE_BUILD_ID is not set CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 CONFIG_CONSOLE_LOGLEVEL_QUIET=4 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 # CONFIG_BOOT_PRINTK_DELAY is not set CONFIG_DYNAMIC_DEBUG=y CONFIG_DYNAMIC_DEBUG_CORE=y CONFIG_SYMBOLIC_ERRNAME=y CONFIG_DEBUG_BUGVERBOSE=y # end of printk and dmesg options # # Compile-time checks and compiler options # CONFIG_DEBUG_INFO=y # CONFIG_DEBUG_INFO_REDUCED is not set # CONFIG_DEBUG_INFO_COMPRESSED is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y # CONFIG_DEBUG_INFO_DWARF4 is not set # CONFIG_DEBUG_INFO_DWARF5 is not set # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=0 # CONFIG_STRIP_ASM_SYMS is not set # CONFIG_READABLE_ASM is not set # CONFIG_HEADERS_INSTALL is not set # CONFIG_DEBUG_SECTION_MISMATCH is not set # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set # CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set CONFIG_ARCH_WANT_FRAME_POINTERS=y CONFIG_FRAME_POINTER=y # CONFIG_VMLINUX_MAP is not set # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set # end of Compile-time checks and compiler options # # Generic Kernel Debugging Instruments # CONFIG_MAGIC_SYSRQ=y CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0 CONFIG_MAGIC_SYSRQ_SERIAL=y CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE="" CONFIG_DEBUG_FS=y CONFIG_DEBUG_FS_ALLOW_ALL=y # CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set # CONFIG_DEBUG_FS_ALLOW_NONE is not set CONFIG_HAVE_ARCH_KGDB=y # CONFIG_KGDB is not set CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y # CONFIG_UBSAN is not set CONFIG_HAVE_KCSAN_COMPILER=y # end of Generic Kernel Debugging Instruments CONFIG_DEBUG_KERNEL=y CONFIG_DEBUG_MISC=y # # Memory Debugging # CONFIG_PAGE_EXTENSION=y CONFIG_DEBUG_PAGEALLOC=y # CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT is not set CONFIG_PAGE_OWNER=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set CONFIG_ARCH_HAS_DEBUG_WX=y CONFIG_DEBUG_WX=y CONFIG_GENERIC_PTDUMP=y CONFIG_PTDUMP_CORE=y # CONFIG_PTDUMP_DEBUGFS is not set CONFIG_DEBUG_OBJECTS=y CONFIG_DEBUG_OBJECTS_SELFTEST=y CONFIG_DEBUG_OBJECTS_FREE=y CONFIG_DEBUG_OBJECTS_TIMERS=y CONFIG_DEBUG_OBJECTS_WORK=y CONFIG_DEBUG_OBJECTS_RCU_HEAD=y CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1 CONFIG_SLUB_DEBUG_ON=y # CONFIG_SLUB_STATS is not set CONFIG_HAVE_DEBUG_KMEMLEAK=y # CONFIG_DEBUG_KMEMLEAK is not set CONFIG_DEBUG_STACK_USAGE=y CONFIG_SCHED_STACK_END_CHECK=y CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y CONFIG_DEBUG_VM=y CONFIG_DEBUG_VM_VMACACHE=y CONFIG_DEBUG_VM_RB=y CONFIG_DEBUG_VM_PGFLAGS=y CONFIG_DEBUG_VM_PGTABLE=y CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y CONFIG_DEBUG_VIRTUAL=y CONFIG_DEBUG_MEMORY_INIT=y CONFIG_DEBUG_PER_CPU_MAPS=y CONFIG_HAVE_ARCH_KASAN=y CONFIG_HAVE_ARCH_KASAN_SW_TAGS=y CONFIG_HAVE_ARCH_KASAN_HW_TAGS=y CONFIG_HAVE_ARCH_KASAN_VMALLOC=y CONFIG_CC_HAS_KASAN_GENERIC=y CONFIG_CC_HAS_KASAN_SW_TAGS=y CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y CONFIG_KASAN=y CONFIG_KASAN_GENERIC=y # CONFIG_KASAN_SW_TAGS is not set # CONFIG_KASAN_HW_TAGS is not set # CONFIG_KASAN_OUTLINE is not set CONFIG_KASAN_INLINE=y # CONFIG_KASAN_STACK is not set CONFIG_KASAN_VMALLOC=y # CONFIG_KASAN_MODULE_TEST is not set CONFIG_HAVE_ARCH_KFENCE=y # CONFIG_KFENCE is not set # end of Memory Debugging # CONFIG_DEBUG_SHIRQ is not set # # Debug Oops, Lockups and Hangs # CONFIG_PANIC_ON_OOPS=y CONFIG_PANIC_ON_OOPS_VALUE=1 CONFIG_PANIC_TIMEOUT=-1 CONFIG_LOCKUP_DETECTOR=y CONFIG_SOFTLOCKUP_DETECTOR=y CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=1 CONFIG_DETECT_HUNG_TASK=y CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=1 CONFIG_WQ_WATCHDOG=y # CONFIG_TEST_LOCKUP is not set # end of Debug Oops, Lockups and Hangs # # Scheduler Debugging # CONFIG_SCHED_DEBUG=y CONFIG_SCHED_INFO=y CONFIG_SCHEDSTATS=y # end of Scheduler Debugging # CONFIG_DEBUG_TIMEKEEPING is not set CONFIG_DEBUG_PREEMPT=y # # Lock Debugging (spinlocks, mutexes, etc...) # CONFIG_LOCK_DEBUGGING_SUPPORT=y CONFIG_PROVE_LOCKING=y # CONFIG_PROVE_RAW_LOCK_NESTING is not set CONFIG_LOCK_STAT=y CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_MUTEXES=y CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y CONFIG_DEBUG_RWSEMS=y CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_LOCKDEP=y CONFIG_LOCKDEP_BITS=15 CONFIG_LOCKDEP_CHAINS_BITS=16 CONFIG_LOCKDEP_STACK_TRACE_BITS=19 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14 CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12 # CONFIG_DEBUG_LOCKDEP is not set CONFIG_DEBUG_ATOMIC_SLEEP=y # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set # CONFIG_LOCK_TORTURE_TEST is not set # CONFIG_WW_MUTEX_SELFTEST is not set # CONFIG_SCF_TORTURE_TEST is not set # CONFIG_CSD_LOCK_WAIT_DEBUG is not set # end of Lock Debugging (spinlocks, mutexes, etc...) CONFIG_TRACE_IRQFLAGS=y # CONFIG_DEBUG_IRQFLAGS is not set CONFIG_STACKTRACE=y # CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set # CONFIG_DEBUG_KOBJECT is not set # CONFIG_DEBUG_KOBJECT_RELEASE is not set # # Debug kernel data structures # CONFIG_DEBUG_LIST=y # CONFIG_DEBUG_PLIST is not set CONFIG_DEBUG_SG=y # CONFIG_DEBUG_NOTIFIERS is not set CONFIG_BUG_ON_DATA_CORRUPTION=y # end of Debug kernel data structures CONFIG_DEBUG_CREDENTIALS=y # # RCU Debugging # CONFIG_PROVE_RCU=y # CONFIG_RCU_SCALE_TEST is not set # CONFIG_RCU_TORTURE_TEST is not set # CONFIG_RCU_REF_SCALE_TEST is not set CONFIG_RCU_CPU_STALL_TIMEOUT=21 CONFIG_RCU_TRACE=y # CONFIG_RCU_EQS_DEBUG is not set # end of RCU Debugging # CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set # CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set # CONFIG_LATENCYTOP is not set CONFIG_NOP_TRACER=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_DYNAMIC_FTRACE=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_C_RECORDMCOUNT=y CONFIG_TRACE_CLOCK=y CONFIG_RING_BUFFER=y CONFIG_EVENT_TRACING=y CONFIG_CONTEXT_SWITCH_TRACER=y CONFIG_PREEMPTIRQ_TRACEPOINTS=y CONFIG_TRACING=y CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y CONFIG_FTRACE=y # CONFIG_BOOTTIME_TRACING is not set CONFIG_FUNCTION_TRACER=y CONFIG_FUNCTION_GRAPH_TRACER=y CONFIG_DYNAMIC_FTRACE=y CONFIG_DYNAMIC_FTRACE_WITH_REGS=y # CONFIG_FUNCTION_PROFILER is not set # CONFIG_STACK_TRACER is not set # CONFIG_IRQSOFF_TRACER is not set # CONFIG_PREEMPT_TRACER is not set # CONFIG_SCHED_TRACER is not set # CONFIG_HWLAT_TRACER is not set # CONFIG_OSNOISE_TRACER is not set # CONFIG_TIMERLAT_TRACER is not set # CONFIG_FTRACE_SYSCALLS is not set # CONFIG_TRACER_SNAPSHOT is not set CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set # CONFIG_PROFILE_ALL_BRANCHES is not set CONFIG_BLK_DEV_IO_TRACE=y CONFIG_UPROBE_EVENTS=y CONFIG_BPF_EVENTS=y CONFIG_DYNAMIC_EVENTS=y CONFIG_PROBE_EVENTS=y CONFIG_FTRACE_MCOUNT_RECORD=y CONFIG_FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY=y # CONFIG_SYNTH_EVENTS is not set # CONFIG_HIST_TRIGGERS is not set # CONFIG_TRACE_EVENT_INJECT is not set # CONFIG_TRACEPOINT_BENCHMARK is not set # CONFIG_RING_BUFFER_BENCHMARK is not set # CONFIG_TRACE_EVAL_MAP_FILE is not set # CONFIG_FTRACE_RECORD_RECURSION is not set # CONFIG_FTRACE_STARTUP_TEST is not set # CONFIG_RING_BUFFER_STARTUP_TEST is not set # CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set # CONFIG_PREEMPTIRQ_DELAY_TEST is not set # CONFIG_SAMPLES is not set CONFIG_STRICT_DEVMEM=y # CONFIG_IO_STRICT_DEVMEM is not set # # arm64 Debugging # # CONFIG_PID_IN_CONTEXTIDR is not set # CONFIG_ARM64_RELOC_TEST is not set # CONFIG_CORESIGHT is not set # end of arm64 Debugging # # Kernel Testing and Coverage # # CONFIG_KUNIT is not set # CONFIG_NOTIFIER_ERROR_INJECTION is not set # CONFIG_FAULT_INJECTION is not set CONFIG_ARCH_HAS_KCOV=y CONFIG_CC_HAS_SANCOV_TRACE_PC=y # CONFIG_KCOV is not set CONFIG_RUNTIME_TESTING_MENU=y CONFIG_LKDTM=y # CONFIG_TEST_MIN_HEAP is not set # CONFIG_TEST_SORT is not set # CONFIG_TEST_DIV64 is not set # CONFIG_BACKTRACE_SELF_TEST is not set # CONFIG_RBTREE_TEST is not set # CONFIG_REED_SOLOMON_TEST is not set # CONFIG_INTERVAL_TREE_TEST is not set # CONFIG_PERCPU_TEST is not set # CONFIG_ATOMIC64_SELFTEST is not set # CONFIG_TEST_HEXDUMP is not set # CONFIG_STRING_SELFTEST is not set # CONFIG_TEST_STRING_HELPERS is not set # CONFIG_TEST_STRSCPY is not set # CONFIG_TEST_KSTRTOX is not set # CONFIG_TEST_PRINTF is not set # CONFIG_TEST_SCANF is not set # CONFIG_TEST_BITMAP is not set # CONFIG_TEST_UUID is not set # CONFIG_TEST_XARRAY is not set # CONFIG_TEST_OVERFLOW is not set # CONFIG_TEST_RHASHTABLE is not set # CONFIG_TEST_HASH is not set # CONFIG_TEST_IDA is not set CONFIG_TEST_LKM=m # CONFIG_TEST_BITOPS is not set # CONFIG_TEST_VMALLOC is not set # CONFIG_TEST_USER_COPY is not set # CONFIG_TEST_BPF is not set # CONFIG_TEST_BLACKHOLE_DEV is not set # CONFIG_FIND_BIT_BENCHMARK is not set CONFIG_TEST_FIRMWARE=m # CONFIG_TEST_SYSCTL is not set CONFIG_TEST_UDELAY=m # CONFIG_TEST_STATIC_KEYS is not set # CONFIG_TEST_KMOD is not set # CONFIG_TEST_DEBUG_VIRTUAL is not set # CONFIG_TEST_MEMCAT_P is not set # CONFIG_TEST_STACKINIT is not set # CONFIG_TEST_MEMINIT is not set # CONFIG_TEST_FREE_PAGES is not set CONFIG_ARCH_USE_MEMTEST=y # CONFIG_MEMTEST is not set # end of Kernel Testing and Coverage # end of Kernel hacking ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-04 17:19 ` Eric W. Biederman 2021-10-04 21:34 ` Yu Zhao @ 2021-10-06 7:57 ` Rune Kleveland 2021-10-10 8:59 ` Rune Kleveland 2021-10-11 13:39 ` linux 5.14.3: free_user_ns causes NULL pointer dereference Alexey Gladkov 3 siblings, 0 replies; 70+ messages in thread From: Rune Kleveland @ 2021-10-06 7:57 UTC (permalink / raw) To: Eric W. Biederman, Yu Zhao Cc: Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers [-- Attachment #1: Type: text/plain, Size: 25269 bytes --] Hi! Thank you for all your efforts with this issue! I am using the stock Fedora 34 kernel. The failures happen quite frequently. It varies from an hour to a couple of days before the hang, and it appens on all the IBM blades and less frequently on HP DL380 G7. The servers run selenimm-controlled Google Chrome compiled by Google, and that produces some traps. They It's quite high load on them. Here is a new trace looking a bit different. Maybe some clues in there? Oct 06 08:12:17.709377 kant4.opoint.com kernel: BUG: kernel NULL pointer dereference, address: 0000000000000251 Oct 06 08:12:17.709641 kant4.opoint.com kernel: #PF: supervisor read access in kernel mode Oct 06 08:12:17.889197 kant4.opoint.com kernel: #PF: error_code(0x0000) - not-present page Oct 06 08:12:17.967596 kant4.opoint.com kernel: PGD 0 P4D 0 Oct 06 08:12:18.051776 kant4.opoint.com kernel: Oops: 0000 [#1] SMP PTI Oct 06 08:12:18.051895 kant4.opoint.com kernel: CPU: 9 PID: 3337825 Comm: chrome Not tainted 5.14.9-200.fc34.x86_64 #1 Oct 06 08:12:18.051962 kant4.opoint.com kernel: Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8163, BIOS -[P9E164CUS-1.28]- 04/17/2018 Oct 06 08:12:18.052022 kant4.opoint.com kernel: RIP: 0010:is_ucounts_overlimit+0x42/0x60 Oct 06 08:12:18.052080 kant4.opoint.com kernel: Code: 8d 14 07 48 8b 0a 4c 39 c9 77 30 48 85 ff 74 2c 48 83 c6 3e eb 10 48 8b b8 e8 01 00 00 48 85 ff 74 1a 4a 8d 14 07 48 8b 47 10 <48> 8b 0c f0 48 8b 12 48 39 ca 76 e0 b8 01 00 00 00 c3 3> Oct 06 08:12:18.052154 kant4.opoint.com kernel: RSP: 0018:ffffb8118f9ffdc8 EFLAGS: 00010212 Oct 06 08:12:18.052227 kant4.opoint.com kernel: RAX: 0000000000000001 RBX: ffff994b86f77bc0 RCX: 0000000000000000 Oct 06 08:12:18.052344 kant4.opoint.com kernel: RDX: ffff994b86f77c40 RSI: 000000000000004a RDI: ffff994b86f77bc0 Oct 06 08:12:18.052452 kant4.opoint.com kernel: RBP: ffffb8118f9ffe60 R08: 0000000000000080 R09: 0000000000075f6b Oct 06 08:12:18.052523 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000000 R12: ffffb8118f9ffed0 Oct 06 08:12:18.052613 kant4.opoint.com kernel: R13: 0000000000000000 R14: 00000000003d0f00 R15: ffff995f0d0e8000 Oct 06 08:12:18.052701 kant4.opoint.com kernel: FS: 00007f2bc6c01d80(0000) GS:ffff99689fac0000(0000) knlGS:0000000000000000 Oct 06 08:12:18.052774 kant4.opoint.com kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 06 08:12:18.052850 kant4.opoint.com kernel: CR2: 0000000000000251 CR3: 0000000a98dae005 CR4: 00000000000206e0 Oct 06 08:12:18.052923 kant4.opoint.com kernel: Call Trace: Oct 06 08:12:18.052989 kant4.opoint.com kernel: copy_process+0x444/0x1c20 Oct 06 08:12:18.053116 kant4.opoint.com kernel: kernel_clone+0x87/0x380 Oct 06 08:12:18.053185 kant4.opoint.com kernel: __do_sys_clone+0x52/0x60 Oct 06 08:12:18.053251 kant4.opoint.com kernel: do_syscall_64+0x3b/0x90 Oct 06 08:12:18.053366 kant4.opoint.com kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae Oct 06 08:12:18.053450 kant4.opoint.com kernel: RIP: 0033:0x7f2bc8288345 Oct 06 08:12:18.053536 kant4.opoint.com kernel: Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3> Oct 06 08:12:18.053640 kant4.opoint.com kernel: RSP: 002b:00007ffc07a6d8e8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 Oct 06 08:12:18.053743 kant4.opoint.com kernel: RAX: ffffffffffffffda RBX: 00007f2bacbb3640 RCX: 00007f2bc8288345 Oct 06 08:12:18.053888 kant4.opoint.com kernel: RDX: 00007f2bacbb3910 RSI: 00007f2bacbb28b0 RDI: 00000000003d0f00 Oct 05 16:08:07.573709 kant4.opoint.com kernel: traps: chrome[1578552] trap invalid opcode ip:557906685910 sp:7ffcbd31bde0 error:0 in chrome[55790650a000+857b000] Oct 05 16:53:44.208521 kant4.opoint.com kernel: traps: chrome[1849193] trap invalid opcode ip:55c1a0bb7910 sp:7ffd510ac860 error:0 in chrome[55c1a0a3c000+857b000] Oct 05 17:25:37.631729 kant4.opoint.com kernel: traps: chrome[2023334] trap invalid opcode ip:55dea0728910 sp:7ffefcec5300 error:0 in chrome[55dea05ad000+857b000] Oct 05 20:21:30.226448 kant4.opoint.com kernel: traps: chrome[3288200] trap invalid opcode ip:55d913483b9f sp:7ffcedbf57f0 error:0 in chrome[55d90ea9a000+857b000] Oct 05 21:21:12.211391 kant4.opoint.com kernel: traps: chrome[3659878] trap invalid opcode ip:56503e2a0910 sp:7ffca7949460 error:0 in chrome[56503e125000+857b000] Oct 05 22:16:34.325471 kant4.opoint.com kernel: traps: chrome[3954333] trap invalid opcode ip:55ac2f16b910 sp:7fffd3621fe0 error:0 in chrome[55ac2eff0000+857b000] Oct 05 22:52:28.831375 kant4.opoint.com kernel: traps: chrome[4165973] trap invalid opcode ip:55bb31ccc910 sp:7fff26662d80 error:0 in chrome[55bb31b51000+857b000] Oct 06 08:02:07.417376 kant4.opoint.com kernel: getlink4[3251694]: segfault at 0 ip 00007f2bdbabc0c0 sp 00007fffff169a38 error 4 in libc-2.33.so[7f2bdb98b000+14d000] Oct 06 08:02:07.417455 kant4.opoint.com kernel: Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 7> Oct 06 08:07:31.375414 kant4.opoint.com kernel: getlink8[3251723]: segfault at 0 ip 00007fb8ee8de0c0 sp 00007ffe9eae5898 error 4 in libc-2.33.so[7fb8ee7ad000+14d000] Oct 06 08:07:31.375744 kant4.opoint.com kernel: Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 7> Oct 06 08:11:44.148749 kant4.opoint.com kernel: getlink8[3310785]: segfault at 0 ip 00007f30262810c0 sp 00007ffd8d263db8 error 4 in libc-2.33.so[7f3026150000+14d000] Oct 06 08:11:44.148859 kant4.opoint.com kernel: Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 7> Oct 06 08:12:17.709377 kant4.opoint.com kernel: BUG: kernel NULL pointer dereference, address: 0000000000000251 Oct 06 08:11:44.148749 kant4.opoint.com kernel: getlink8[3310785]: segfault at 0 ip 00007f30262810c0 sp 00007ffd8d263db8 error 4 in libc-2.33.so[7f3026150000+14d000] Oct 06 08:11:44.148859 kant4.opoint.com kernel: Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 7> Oct 06 08:11:44.148749 kant4.opoint.com kernel: getlink8[3310785]: segfault at 0 ip 00007f30262810c0 sp 00007ffd8d263db8 error 4 in libc-2.33.so[7f3026150000+14d000] Oct 06 08:11:44.148859 kant4.opoint.com kernel: Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 7> Oct 06 08:12:17.709377 kant4.opoint.com kernel: BUG: kernel NULL pointer dereference, address: 0000000000000251 Oct 06 08:12:17.709641 kant4.opoint.com kernel: #PF: supervisor read access in kernel mode Oct 06 08:12:17.889197 kant4.opoint.com kernel: #PF: error_code(0x0000) - not-present page Oct 06 08:12:17.967596 kant4.opoint.com kernel: PGD 0 P4D 0 Oct 06 08:12:18.051776 kant4.opoint.com kernel: Oops: 0000 [#1] SMP PTI Oct 06 08:12:18.051895 kant4.opoint.com kernel: CPU: 9 PID: 3337825 Comm: chrome Not tainted 5.14.9-200.fc34.x86_64 #1 Oct 06 08:12:18.051962 kant4.opoint.com kernel: Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8163, BIOS -[P9E164CUS-1.28]- 04/17/2018 Oct 06 08:12:18.052022 kant4.opoint.com kernel: RIP: 0010:is_ucounts_overlimit+0x42/0x60 Oct 06 08:12:18.052080 kant4.opoint.com kernel: Code: 8d 14 07 48 8b 0a 4c 39 c9 77 30 48 85 ff 74 2c 48 83 c6 3e eb 10 48 8b b8 e8 01 00 00 48 85 ff 74 1a 4a 8d 14 07 48 8b 47 10 <48> 8b 0c f0 48 8b 12 48 39 ca 76 e0 b8 01 00 00 00 c3 3> Oct 06 08:12:18.052154 kant4.opoint.com kernel: RSP: 0018:ffffb8118f9ffdc8 EFLAGS: 00010212 Oct 06 08:12:18.052227 kant4.opoint.com kernel: RAX: 0000000000000001 RBX: ffff994b86f77bc0 RCX: 0000000000000000 Oct 06 08:12:18.052344 kant4.opoint.com kernel: RDX: ffff994b86f77c40 RSI: 000000000000004a RDI: ffff994b86f77bc0 Oct 06 08:12:18.052452 kant4.opoint.com kernel: RBP: ffffb8118f9ffe60 R08: 0000000000000080 R09: 0000000000075f6b Oct 06 08:12:18.052523 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000000 R12: ffffb8118f9ffed0 Oct 06 08:12:18.052613 kant4.opoint.com kernel: R13: 0000000000000000 R14: 00000000003d0f00 R15: ffff995f0d0e8000 Oct 06 08:12:18.052701 kant4.opoint.com kernel: FS: 00007f2bc6c01d80(0000) GS:ffff99689fac0000(0000) knlGS:0000000000000000 Oct 06 08:12:18.052774 kant4.opoint.com kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 06 08:12:18.052850 kant4.opoint.com kernel: CR2: 0000000000000251 CR3: 0000000a98dae005 CR4: 00000000000206e0 Oct 06 08:12:18.052923 kant4.opoint.com kernel: Call Trace: Oct 06 08:12:18.052989 kant4.opoint.com kernel: copy_process+0x444/0x1c20 Oct 06 08:12:18.053116 kant4.opoint.com kernel: kernel_clone+0x87/0x380 Oct 06 08:12:18.053185 kant4.opoint.com kernel: __do_sys_clone+0x52/0x60 Oct 06 08:12:18.053251 kant4.opoint.com kernel: do_syscall_64+0x3b/0x90 Oct 06 08:12:18.053366 kant4.opoint.com kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae Oct 06 08:12:18.053450 kant4.opoint.com kernel: RIP: 0033:0x7f2bc8288345 Oct 06 08:12:18.053536 kant4.opoint.com kernel: Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3> Oct 06 08:12:18.053640 kant4.opoint.com kernel: RSP: 002b:00007ffc07a6d8e8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 Oct 06 08:12:18.053743 kant4.opoint.com kernel: RAX: ffffffffffffffda RBX: 00007f2bacbb3640 RCX: 00007f2bc8288345 Oct 06 08:12:18.053888 kant4.opoint.com kernel: RDX: 00007f2bacbb3910 RSI: 00007f2bacbb28b0 RDI: 00000000003d0f00 Oct 06 08:12:18.053955 kant4.opoint.com kernel: RBP: 00007ffc07a6dc10 R08: 00007f2bacbb3640 R09: 00007f2bacbb3640 Oct 06 08:12:18.054025 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000202 R12: 00007ffc07a6d9ae Oct 06 08:12:18.054091 kant4.opoint.com kernel: R13: 00007ffc07a6d9af R14: 0000000000000000 R15: 00007f2bacbb3640 Oct 06 08:12:18.054162 kant4.opoint.com kernel: Modules linked in: binfmt_misc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_i> Oct 06 08:12:18.054308 kant4.opoint.com kernel: CR2: 0000000000000251 Oct 06 08:12:18.054386 kant4.opoint.com kernel: ---[ end trace 08aecc7d786b859c ]--- Oct 06 08:12:18.054450 kant4.opoint.com kernel: RIP: 0010:is_ucounts_overlimit+0x42/0x60 Oct 06 08:12:18.054509 kant4.opoint.com kernel: Code: 8d 14 07 48 8b 0a 4c 39 c9 77 30 48 85 ff 74 2c 48 83 c6 3e eb 10 48 8b b8 e8 01 00 00 48 85 ff 74 1a 4a 8d 14 07 48 8b 47 10 <48> 8b 0c f0 48 8b 12 48 39 ca 76 e0 b8 01 00 00 00 c3 3> Oct 06 08:12:18.054578 kant4.opoint.com kernel: RSP: 0018:ffffb8118f9ffdc8 EFLAGS: 00010212 Oct 06 08:12:18.054637 kant4.opoint.com kernel: RAX: 0000000000000001 RBX: ffff994b86f77bc0 RCX: 0000000000000000 Oct 06 08:12:18.054680 kant4.opoint.com kernel: RDX: ffff994b86f77c40 RSI: 000000000000004a RDI: ffff994b86f77bc0 Oct 06 08:12:18.054729 kant4.opoint.com kernel: RBP: ffffb8118f9ffe60 R08: 0000000000000080 R09: 0000000000075f6b Oct 06 08:12:18.054769 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000000 R12: ffffb8118f9ffed0 Oct 06 08:12:18.054806 kant4.opoint.com kernel: R13: 0000000000000000 R14: 00000000003d0f00 R15: ffff995f0d0e8000 Oct 06 08:12:18.054841 kant4.opoint.com kernel: FS: 00007f2bc6c01d80(0000) GS:ffff99689fac0000(0000) knlGS:0000000000000000 Oct 06 08:12:18.054876 kant4.opoint.com kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 06 08:12:18.054922 kant4.opoint.com kernel: CR2: 0000000000000251 CR3: 0000000a98dae005 CR4: 00000000000206e0 Oct 06 08:12:20.369065 kant4.opoint.com kernel: traps: chrome[3242064] trap invalid opcode ip:55a5975a8910 sp:7ffe43768e20 error:0 in chrome[55a59742d000+857b000] Oct 06 08:12:24.954402 kant4.opoint.com kernel: BUG: kernel NULL pointer dereference, address: 0000000000000251 Oct 06 08:12:24.954696 kant4.opoint.com kernel: #PF: supervisor read access in kernel mode Oct 06 08:12:25.230724 kant4.opoint.com kernel: #PF: error_code(0x0000) - not-present page Oct 06 08:12:25.234392 kant4.opoint.com kernel: PGD 0 P4D 0 Oct 06 08:12:25.234606 kant4.opoint.com kernel: Oops: 0000 [#2] SMP PTI Oct 06 08:12:25.234686 kant4.opoint.com kernel: CPU: 4 PID: 3337732 Comm: ThreadPoolForeg Tainted: G D 5.14.9-200.fc34.x86_64 #1 Oct 06 08:12:25.234756 kant4.opoint.com kernel: Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8163, BIOS -[P9E164CUS-1.28]- 04/17/2018 ^X Oct 06 08:11:44.148859 kant4.opoint.com kernel: Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 74 ca 66 0f Oct 06 08:12:17.709377 kant4.opoint.com kernel: BUG: kernel NULL pointer dereference, address: 0000000000000251 Oct 06 08:12:17.709641 kant4.opoint.com kernel: #PF: supervisor read access in kernel mode Oct 06 08:12:17.889197 kant4.opoint.com kernel: #PF: error_code(0x0000) - not-present page Oct 06 08:12:17.967596 kant4.opoint.com kernel: PGD 0 P4D 0 Oct 06 08:12:18.051776 kant4.opoint.com kernel: Oops: 0000 [#1] SMP PTI Oct 06 08:12:18.051895 kant4.opoint.com kernel: CPU: 9 PID: 3337825 Comm: chrome Not tainted 5.14.9-200.fc34.x86_64 #1 Oct 06 08:12:18.051962 kant4.opoint.com kernel: Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8163, BIOS -[P9E164CUS-1.28]- 04/17/2018 Oct 06 08:12:18.052022 kant4.opoint.com kernel: RIP: 0010:is_ucounts_overlimit+0x42/0x60 Oct 06 08:12:18.052080 kant4.opoint.com kernel: Code: 8d 14 07 48 8b 0a 4c 39 c9 77 30 48 85 ff 74 2c 48 83 c6 3e eb 10 48 8b b8 e8 01 00 00 48 85 ff 74 1a 4a 8d 14 07 48 8b 47 10 <48> 8b 0c f0 48 8b 12 48 39 ca 76 e0 b8 01 00 00 00 c3 31 c0 c3 cc Oct 06 08:12:18.052154 kant4.opoint.com kernel: RSP: 0018:ffffb8118f9ffdc8 EFLAGS: 00010212 Oct 06 08:12:18.052227 kant4.opoint.com kernel: RAX: 0000000000000001 RBX: ffff994b86f77bc0 RCX: 0000000000000000 Oct 06 08:12:18.052344 kant4.opoint.com kernel: RDX: ffff994b86f77c40 RSI: 000000000000004a RDI: ffff994b86f77bc0 Oct 06 08:12:18.052452 kant4.opoint.com kernel: RBP: ffffb8118f9ffe60 R08: 0000000000000080 R09: 0000000000075f6b Oct 06 08:12:18.052523 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000000 R12: ffffb8118f9ffed0 Oct 06 08:12:18.052613 kant4.opoint.com kernel: R13: 0000000000000000 R14: 00000000003d0f00 R15: ffff995f0d0e8000 Oct 06 08:12:18.052701 kant4.opoint.com kernel: FS: 00007f2bc6c01d80(0000) GS:ffff99689fac0000(0000) knlGS:0000000000000000 Oct 06 08:12:18.052774 kant4.opoint.com kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 06 08:12:18.052850 kant4.opoint.com kernel: CR2: 0000000000000251 CR3: 0000000a98dae005 CR4: 00000000000206e0 Oct 06 08:12:18.052923 kant4.opoint.com kernel: Call Trace: Oct 06 08:12:18.052989 kant4.opoint.com kernel: copy_process+0x444/0x1c20 Oct 06 08:12:18.053116 kant4.opoint.com kernel: kernel_clone+0x87/0x380 Oct 06 08:12:18.053185 kant4.opoint.com kernel: __do_sys_clone+0x52/0x60 Oct 06 08:12:18.053251 kant4.opoint.com kernel: do_syscall_64+0x3b/0x90 Oct 06 08:12:18.053366 kant4.opoint.com kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae Oct 06 08:12:18.053450 kant4.opoint.com kernel: RIP: 0033:0x7f2bc8288345 Oct 06 08:12:18.053536 kant4.opoint.com kernel: Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 Oct 06 08:12:18.053640 kant4.opoint.com kernel: RSP: 002b:00007ffc07a6d8e8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 Oct 06 08:12:18.053743 kant4.opoint.com kernel: RAX: ffffffffffffffda RBX: 00007f2bacbb3640 RCX: 00007f2bc8288345 Oct 06 08:12:18.053888 kant4.opoint.com kernel: RDX: 00007f2bacbb3910 RSI: 00007f2bacbb28b0 RDI: 00000000003d0f00 Oct 06 08:12:18.053955 kant4.opoint.com kernel: RBP: 00007ffc07a6dc10 R08: 00007f2bacbb3640 R09: 00007f2bacbb3640 Oct 06 08:12:18.054025 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000202 R12: 00007ffc07a6d9ae Oct 06 08:12:18.054091 kant4.opoint.com kernel: R13: 00007ffc07a6d9af R14: 0000000000000000 R15: 00007f2bacbb3640 Oct 06 08:12:18.054162 kant4.opoint.com kernel: Modules linked in: binfmt_misc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_> Oct 06 08:12:18.054308 kant4.opoint.com kernel: CR2: 0000000000000251 Oct 06 08:12:18.054386 kant4.opoint.com kernel: ---[ end trace 08aecc7d786b859c ]--- Oct 06 08:12:18.054450 kant4.opoint.com kernel: RIP: 0010:is_ucounts_overlimit+0x42/0x60 Oct 06 08:12:18.054509 kant4.opoint.com kernel: Code: 8d 14 07 48 8b 0a 4c 39 c9 77 30 48 85 ff 74 2c 48 83 c6 3e eb 10 48 8b b8 e8 01 00 00 48 85 ff 74 1a 4a 8d 14 07 48 8b 47 10 <48> 8b 0c f0 48 8b 12 48 39 ca 76 e0 b8 01 00 00 00 c3 31 c0 c3 cc Oct 06 08:12:18.054578 kant4.opoint.com kernel: RSP: 0018:ffffb8118f9ffdc8 EFLAGS: 00010212 Oct 06 08:12:18.054637 kant4.opoint.com kernel: RAX: 0000000000000001 RBX: ffff994b86f77bc0 RCX: 0000000000000000 Oct 06 08:12:18.054680 kant4.opoint.com kernel: RDX: ffff994b86f77c40 RSI: 000000000000004a RDI: ffff994b86f77bc0 Oct 06 08:12:18.054729 kant4.opoint.com kernel: RBP: ffffb8118f9ffe60 R08: 0000000000000080 R09: 0000000000075f6b Oct 06 08:12:18.054769 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000000 R12: ffffb8118f9ffed0 Oct 06 08:12:18.054806 kant4.opoint.com kernel: R13: 0000000000000000 R14: 00000000003d0f00 R15: ffff995f0d0e8000 Oct 06 08:12:18.054841 kant4.opoint.com kernel: FS: 00007f2bc6c01d80(0000) GS:ffff99689fac0000(0000) knlGS:0000000000000000 Oct 06 08:12:18.054876 kant4.opoint.com kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 06 08:12:18.054922 kant4.opoint.com kernel: CR2: 0000000000000251 CR3: 0000000a98dae005 CR4: 00000000000206e0 Oct 06 08:12:20.369065 kant4.opoint.com kernel: traps: chrome[3242064] trap invalid opcode ip:55a5975a8910 sp:7ffe43768e20 error:0 in chrome[55a59742d000+857b000] Oct 06 08:12:24.954402 kant4.opoint.com kernel: BUG: kernel NULL pointer dereference, address: 0000000000000251 Oct 06 08:12:24.954696 kant4.opoint.com kernel: #PF: supervisor read access in kernel mode Oct 06 08:12:25.230724 kant4.opoint.com kernel: #PF: error_code(0x0000) - not-present page Oct 06 08:12:25.234392 kant4.opoint.com kernel: PGD 0 P4D 0 Oct 06 08:12:25.234606 kant4.opoint.com kernel: Oops: 0000 [#2] SMP PTI Oct 06 08:12:25.234686 kant4.opoint.com kernel: CPU: 4 PID: 3337732 Comm: ThreadPoolForeg Tainted: G D 5.14.9-200.fc34.x86_64 #1 Oct 06 08:12:25.234756 kant4.opoint.com kernel: Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8163, BIOS -[P9E164CUS-1.28]- 04/17/2018 Oct 06 08:12:25.234818 kant4.opoint.com kernel: RIP: 0010:is_ucounts_overlimit+0x42/0x60 Oct 06 08:12:25.234881 kant4.opoint.com kernel: Code: 8d 14 07 48 8b 0a 4c 39 c9 77 30 48 85 ff 74 2c 48 83 c6 3e eb 10 48 8b b8 e8 01 00 00 48 85 ff 74 1a 4a 8d 14 07 48 8b 47 10 <48> 8b 0c f0 48 8b 12 48 39 ca 76 e0 b8 01 00 00 00 c3 31 c0 c3 cc Oct 06 08:12:25.234949 kant4.opoint.com kernel: RSP: 0018:ffffb81189d5fdc8 EFLAGS: 00010212 Oct 06 08:12:25.235017 kant4.opoint.com kernel: RAX: 0000000000000001 RBX: ffff994b86f77bc0 RCX: 0000000000000000 Oct 06 08:12:25.235079 kant4.opoint.com kernel: RDX: ffff994b86f77c40 RSI: 000000000000004a RDI: ffff994b86f77bc0 Oct 06 08:12:25.235142 kant4.opoint.com kernel: RBP: ffffb81189d5fe60 R08: 0000000000000080 R09: 0000000000075f6b Oct 06 08:12:25.235227 kant4.opoint.com kernel: R10: 00000000e846208d R11: 0000000075572f44 R12: ffffb81189d5fed0 Oct 06 08:12:25.235307 kant4.opoint.com kernel: R13: 0000000000000000 R14: 00000000003d0f00 R15: ffff994be4dc2680 Oct 06 08:12:25.235420 kant4.opoint.com kernel: FS: 00007fea1f676640(0000) GS:ffff9950e7b00000(0000) knlGS:0000000000000000 Oct 06 08:12:25.235491 kant4.opoint.com kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 06 08:12:25.235571 kant4.opoint.com kernel: CR2: 0000000000000251 CR3: 0000000692ffc003 CR4: 00000000000206e0 Oct 06 08:12:25.235654 kant4.opoint.com kernel: Call Trace: lines 1191-1257/1834 62% Oct 06 08:11:44.148859 kant4.opoint.com kernel: Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 74 ca 66 0f Oct 06 08:12:17.709377 kant4.opoint.com kernel: BUG: kernel NULL pointer dereference, address: 0000000000000251 Oct 06 08:12:17.709641 kant4.opoint.com kernel: #PF: supervisor read access in kernel mode Oct 06 08:12:17.889197 kant4.opoint.com kernel: #PF: error_code(0x0000) - not-present page Oct 06 08:12:17.967596 kant4.opoint.com kernel: PGD 0 P4D 0 Oct 06 08:12:18.051776 kant4.opoint.com kernel: Oops: 0000 [#1] SMP PTI Oct 06 08:12:18.051895 kant4.opoint.com kernel: CPU: 9 PID: 3337825 Comm: chrome Not tainted 5.14.9-200.fc34.x86_64 #1 Oct 06 08:12:18.051962 kant4.opoint.com kernel: Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8163, BIOS -[P9E164CUS-1.28]- 04/17/2018 Oct 06 08:12:18.052022 kant4.opoint.com kernel: RIP: 0010:is_ucounts_overlimit+0x42/0x60 Oct 06 08:12:18.052080 kant4.opoint.com kernel: Code: 8d 14 07 48 8b 0a 4c 39 c9 77 30 48 85 ff 74 2c 48 83 c6 3e eb 10 48 8b b8 e8 01 00 00 48 85 ff 74 1a 4a 8d 14 07 48 8b 47 10 <48> 8b 0c f0 48 8b 12 48 39 ca 76 e0 b8 01 00 00 00 c3 31 c0 c3 cc Oct 06 08:12:18.052154 kant4.opoint.com kernel: RSP: 0018:ffffb8118f9ffdc8 EFLAGS: 00010212 Oct 06 08:12:18.052227 kant4.opoint.com kernel: RAX: 0000000000000001 RBX: ffff994b86f77bc0 RCX: 0000000000000000 Oct 06 08:12:18.052344 kant4.opoint.com kernel: RDX: ffff994b86f77c40 RSI: 000000000000004a RDI: ffff994b86f77bc0 Oct 06 08:12:18.052452 kant4.opoint.com kernel: RBP: ffffb8118f9ffe60 R08: 0000000000000080 R09: 0000000000075f6b Oct 06 08:12:18.052523 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000000 R12: ffffb8118f9ffed0 Oct 06 08:12:18.052613 kant4.opoint.com kernel: R13: 0000000000000000 R14: 00000000003d0f00 R15: ffff995f0d0e8000 Oct 06 08:12:18.052701 kant4.opoint.com kernel: FS: 00007f2bc6c01d80(0000) GS:ffff99689fac0000(0000) knlGS:0000000000000000 Oct 06 08:12:18.052774 kant4.opoint.com kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 06 08:12:18.052850 kant4.opoint.com kernel: CR2: 0000000000000251 CR3: 0000000a98dae005 CR4: 00000000000206e0 Oct 06 08:12:18.052923 kant4.opoint.com kernel: Call Trace: Oct 06 08:12:18.052989 kant4.opoint.com kernel: copy_process+0x444/0x1c20 Oct 06 08:12:18.053116 kant4.opoint.com kernel: kernel_clone+0x87/0x380 Oct 06 08:12:18.053185 kant4.opoint.com kernel: __do_sys_clone+0x52/0x60 Oct 06 08:12:18.053251 kant4.opoint.com kernel: do_syscall_64+0x3b/0x90 Oct 06 08:12:18.053366 kant4.opoint.com kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae Oct 06 08:12:18.053450 kant4.opoint.com kernel: RIP: 0033:0x7f2bc8288345 Oct 06 08:12:18.053536 kant4.opoint.com kernel: Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 Oct 06 08:12:18.053640 kant4.opoint.com kernel: RSP: 002b:00007ffc07a6d8e8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 Oct 06 08:12:18.053743 kant4.opoint.com kernel: RAX: ffffffffffffffda RBX: 00007f2bacbb3640 RCX: 00007f2bc8288345 Oct 06 08:12:18.053888 kant4.opoint.com kernel: RDX: 00007f2bacbb3910 RSI: 00007f2bacbb28b0 RDI: 00000000003d0f00 Oct 06 08:12:18.053955 kant4.opoint.com kernel: RBP: 00007ffc07a6dc10 R08: 00007f2bacbb3640 R09: 00007f2bacbb3640 Oct 06 08:12:18.054025 kant4.opoint.com kernel: R10: 00007f2bacbb3910 R11: 0000000000000202 R12: 00007ffc07a6d9ae Oct 06 08:12:18.054091 kant4.opoint.com kernel: R13: 00007ffc07a6d9af R14: 0000000000000000 R15: 00007f2bacbb3640 Oct 06 08:12:18.054162 kant4.opoint.com kernel: Modules linked in: binfmt_misc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtabl> Oct 06 08:12:18.054308 kant4.opoint.com kernel: CR2: 0000000000000251 Oct 06 08:12:18.054386 kant4.opoint.com kernel: ---[ end trace 08aecc7d786b859c ] -- Best regards / Med vennlig hilsen *Rune Kleveland* CTO, Opoint Technology Part of Infomedia Mob: +47 95 08 89 25 rune.kleveland@infomedia.dk <mailto:jat@infomedia.dk> [-- Attachment #2: Type: text/html, Size: 29923 bytes --] ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-04 17:19 ` Eric W. Biederman 2021-10-04 21:34 ` Yu Zhao 2021-10-06 7:57 ` Rune Kleveland @ 2021-10-10 8:59 ` Rune Kleveland 2021-10-11 13:09 ` Hillf Danton ` (2 more replies) 2021-10-11 13:39 ` linux 5.14.3: free_user_ns causes NULL pointer dereference Alexey Gladkov 3 siblings, 3 replies; 70+ messages in thread From: Rune Kleveland @ 2021-10-10 8:59 UTC (permalink / raw) To: Eric W. Biederman, Yu Zhao Cc: Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers Hi! Just wanted to let you know that I still get these on stock Fedora kernel 5.14.10 on the IBM blades. But it took 10 hours before the first server crashed. The other 4 still runs fine since 15 hours ago. So for me it seems more stable now, but that could just be a coincidence. Best regards, Rune ------------[ cut here ]------------ kernel BUG at mm/slub.c:321! invalid opcode: 0000 [#1] SMP PTI CPU: 22 PID: 1838853 Comm: python3 Not tainted 5.14.10-200.fc34.x86_64 #1 Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8161, BIOS -[P9E164CUS-1.28]- 04/17/2018 RIP: 0010:__slab_free+0x245/0x4a0 Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 FS: 00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 Call Trace: ? filename_lookup+0x135/0x1b0 ? put_ucounts+0x65/0x70 kfree+0x369/0x3c0 put_ucounts+0x65/0x70 put_cred_rcu+0x70/0xd0 do_faccessat+0x113/0x240 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f7a899cc44b Code: 77 05 c3 0f 1f 40 00 48 8b 15 29 1a 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 0f 1f 40 00 f3 0f 1e fa b8 15 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 f9 19 0> RSP: 002b:00007ffd01fa9ce8 EFLAGS: 00000202 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7a899cc44b RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f79a96d6e10 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007f7a7c1fb930 R10: 00007f79a96d6000 R11: 0000000000000202 R12: 00007ffd01fa9d00 R13: 0000000000000001 R14: 0000556841045c90 R15: 00000000ffffff9c Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_rejec> ---[ end trace 0a81b150eacde1d5 ]--- RIP: 0010:__slab_free+0x245/0x4a0 Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 FS: 00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 ------------[ cut here ]------------ On 04/10/2021 19:19, Eric W. Biederman wrote: > ebiederm@xmission.com (Eric W. Biederman) writes: > >> Adding Rune Kleveland to the discussion as he also seems to have >> reproduced the issue. >> >> Alex and I have been starring at the code and the reports and this >> bug is hiding well. Here is what we have figured out so far. >> >> Both the warning from free_user_ns calling dec_ucount that Jordan Glover >> reported and the KASAN error that Yu Zhao has reported appear to have >> the same cause. Using a ucounts structure after it has been freed and >> reallocated as something else. >> >> I have just skimmed through the recent report from Rune Kleveland >> and it appears also to be a use after free. Especially since the >> second failure in the log is slub complaining about trying to free >> the ucounts data structure. >> >> We looked through the users of put_ucounts and we don't see any obvious >> buggy users that would be freeing the data structure early. >> >> Alex has tried to reproduce this so far is not having any luck. >> Folks can you tell what compiler versions you are using and share your >> kernel config with us? That might help. >> >> The little debug diff below is my guess of what is happening. If the >> folks who can reproduce this issue can try the patch below and let me >> know if the warnings fire that would be appreciated. It is still not >> enough to track down the bug but at least it will confirm my current >> hypothesis about how things look before there is a use of memory after >> it is freed. > Bah. Scratch that test patch. I just double checked myself and > cred->ucounts and cred->user_ns->ucounts should never be equal, > as the user namespace is counted in it's parent user namespace. > > That observation now tells me I have a parent user namespace that went > corrupt. > > Back to the drawing board. > > >> Thank you, >> Eric >> >> diff --git a/kernel/cred.c b/kernel/cred.c >> index f784e08c2fbd..e7ffaa3cf5a6 100644 >> --- a/kernel/cred.c >> +++ b/kernel/cred.c >> @@ -120,6 +120,12 @@ static void put_cred_rcu(struct rcu_head *rcu) >> if (cred->group_info) >> put_group_info(cred->group_info); >> free_uid(cred->user); >> +#if 1 >> + if ((cred->ucounts == cred->user_ns->ucounts) && >> + (atomic_read(&cred->ucounts->count) == 1)) { >> + WARN_ONCE(1, "put_cred_rcu: ucount count 1\n"); >> + } >> +#endif >> if (cred->ucounts) >> put_ucounts(cred->ucounts); >> put_user_ns(cred->user_ns); >> diff --git a/kernel/exit.c b/kernel/exit.c >> index 91a43e57a32e..60fd88b34c1a 100644 >> --- a/kernel/exit.c >> +++ b/kernel/exit.c >> @@ -743,6 +743,13 @@ void __noreturn do_exit(long code) >> if (unlikely(!tsk->pid)) >> panic("Attempted to kill the idle task!"); >> >> +#if 1 >> + if ((tsk->cred->ucounts == tsk->cred->user_ns->ucounts) && >> + (atomic_read(tsk->cred->ucounts->count) == 1)) { >> + WARN_ONCE(1, "do_exit: ucount count 1\n"); >> + } >> +#endif >> + >> /* >> * If do_exit is called because this processes oopsed, it's possible >> * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-10 8:59 ` Rune Kleveland @ 2021-10-11 13:09 ` Hillf Danton 2021-10-12 17:31 ` Eric W. Biederman 2021-10-15 22:10 ` [CFT][PATCH] ucounts: Fix signal ucount refcounting Eric W. Biederman 2 siblings, 0 replies; 70+ messages in thread From: Hillf Danton @ 2021-10-11 13:09 UTC (permalink / raw) To: Rune Kleveland Cc: Yu Zhao, Eric W. Biederman, Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers On Sun, 10 Oct 2021 10:59:10 +0200 Rune Kleveland wrote: > Just wanted to let you know that I still get these on stock Fedora > kernel 5.14.10 on the IBM blades. But it took 10 hours before the first Thanks for your report. > server crashed. The other 4 still runs fine since 15 hours ago. So for > me it seems more stable now, but that could just be a coincidence. > > Best regards, > > Rune > > ------------[ cut here ]------------ > kernel BUG at mm/slub.c:321! We did not see this before. > invalid opcode: 0000 [#1] SMP PTI > CPU: 22 PID: 1838853 Comm: python3 Not tainted 5.14.10-200.fc34.x86_64 #1 > Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8161, BIOS > -[P9E164CUS-1.28]- 04/17/2018 > RIP: 0010:__slab_free+0x245/0x4a0 > Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b > 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49 > 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> > RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 > RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 > RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 > RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 > R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 > R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 > FS: 00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 > Call Trace: > ? filename_lookup+0x135/0x1b0 > ? put_ucounts+0x65/0x70 > kfree+0x369/0x3c0 > put_ucounts+0x65/0x70 > put_cred_rcu+0x70/0xd0 > do_faccessat+0x113/0x240 > do_syscall_64+0x3b/0x90 > entry_SYSCALL_64_after_hwframe+0x44/0xae > RIP: 0033:0x7f7a899cc44b > Code: 77 05 c3 0f 1f 40 00 48 8b 15 29 1a 0d 00 f7 d8 64 89 02 48 c7 c0 > ff ff ff ff c3 0f 1f 40 00 f3 0f 1e fa b8 15 00 00 00 0f 05 <48> 3d 00 > f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 f9 19 0> > RSP: 002b:00007ffd01fa9ce8 EFLAGS: 00000202 ORIG_RAX: 0000000000000015 > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7a899cc44b > RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f79a96d6e10 > RBP: 0000000000000001 R08: 0000000000000000 R09: 00007f7a7c1fb930 > R10: 00007f79a96d6000 R11: 0000000000000202 R12: 00007ffd01fa9d00 > R13: 0000000000000001 R14: 0000556841045c90 R15: 00000000ffffff9c > Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs > lockd grace sunrpc fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 > nft_fib nft_reject_inet nf_reject_ipv4 nf_rejec> > ---[ end trace 0a81b150eacde1d5 ]--- > RIP: 0010:__slab_free+0x245/0x4a0 > Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b > 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49 > 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> > RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 > RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 > RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 > RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 > R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 > R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 > FS: 00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 > ------------[ cut here ]------------ Although the chance for double free is not zero, corruption can not be ruled out today yet because reports [1,2] in this thread caught no count underflow. Want to know what this DF looks like with kasan enabled. Hillf CPU 1 CPU 2 ----- ----- put_ucounts atomic_dec_and_lock_irqsave get_ucounts hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); put_ucounts atomic_dec_and_lock_irqsave hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); kfree(ucounts); kfree(ucounts); [1] https://lore.kernel.org/linux-mm/CAOUHufaaPoTOCML+v8FomeWtN_PncmaHT9d6-XJG8RPzTcFZug@mail.gmail.com/ [2] https://lore.kernel.org/linux-mm/BCdQdQjRHZ9CJwIhmvKGfnFtMBJuatrZUX5In1gLlPswtrs4HwNONAbJleaeSfOOenMIdc_FPi0wwPIdW5Vodm4Aj-0iCqQY57288M5WFuY=@protonmail.ch/ ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-10 8:59 ` Rune Kleveland 2021-10-11 13:09 ` Hillf Danton @ 2021-10-12 17:31 ` Eric W. Biederman 2021-10-15 22:10 ` [CFT][PATCH] ucounts: Fix signal ucount refcounting Eric W. Biederman 2 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-12 17:31 UTC (permalink / raw) To: Rune Kleveland Cc: Yu Zhao, Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers Rune Kleveland <rune.kleveland@infomedia.dk> writes: > Hi! > > Just wanted to let you know that I still get these on stock Fedora kernel > 5.14.10 on the IBM blades. But it took 10 hours before the first server > crashed. The other 4 still runs fine since 15 hours ago. So for me it seems more > stable now, but that could just be a coincidence. Alex and I have been working on this and we are still tracking down whatever is going on. While we haven't found the issue yet we have found a trivially correct change that allows us to reproduce the issue faster. Hopefully this will allow us to narrow down on whatever it is soon. diff --git a/kernel/ucount.c b/kernel/ucount.c index bb51849e6375..3b7e176cf7a2 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -203,6 +203,7 @@ void put_ucounts(struct ucounts *ucounts) if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { hlist_del_init(&ucounts->node); + ucounts->ns = NULL; spin_unlock_irqrestore(&ucounts_lock, flags); kfree(ucounts); } Eric ^ permalink raw reply related [flat|nested] 70+ messages in thread
* [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-10 8:59 ` Rune Kleveland 2021-10-11 13:09 ` Hillf Danton 2021-10-12 17:31 ` Eric W. Biederman @ 2021-10-15 22:10 ` Eric W. Biederman 2021-10-15 23:09 ` Alexey Gladkov ` (3 more replies) 2 siblings, 4 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-15 22:10 UTC (permalink / raw) To: Rune Kleveland Cc: Yu Zhao, Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers In commit fda31c50292a ("signal: avoid double atomic counter increments for user accounting") Linus made a clever optimization to how rlimits and the struct user_struct. Unfortunately that optimization does not work in the obvious way when moved to nested rlimits. The problem is that the last decrement of the per user namespace per user sigpending counter might also be the last decrement of the sigpending counter in the parent user namespace as well. Which means that simply freeing the leaf ucount in __free_sigqueue is not enough. Maintain the optimization and handle the tricky cases by introducing inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. By moving the entire optimization into functions that perform all of the work it becomes possible to ensure that every level is handled properly. I wish we had a single user across all of the threads whose rlimit could be charged so we did not need this complexity. Cc: stable@vger.kernel.org Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- With a lot of help from Alex who found a way I could reproduce this I believe I have found the issue. Could people who are seeing this issue test and verify this solves the problem for them? include/linux/user_namespace.h | 2 ++ kernel/signal.c | 25 +++++---------------- kernel/ucount.c | 41 ++++++++++++++++++++++++++++++++++ 3 files changed, 49 insertions(+), 19 deletions(-) diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index eb70cabe6e7f..33a4240e6a6f 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); static inline void set_rlimit_ucount_max(struct user_namespace *ns, diff --git a/kernel/signal.c b/kernel/signal.c index a3229add4455..762de58c6e76 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, */ rcu_read_lock(); ucounts = task_ucounts(t); - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); - switch (sigpending) { - case 1: - if (likely(get_ucounts(ucounts))) - break; - fallthrough; - case LONG_MAX: - /* - * we need to decrease the ucount in the userns tree on any - * failure to avoid counts leaking. - */ - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); - rcu_read_unlock(); - return NULL; - } + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); rcu_read_unlock(); + if (sigpending == LONG_MAX) + return NULL; if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, } if (unlikely(q == NULL)) { - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) - put_ucounts(ucounts); + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); } else { INIT_LIST_HEAD(&q->list); q->flags = sigqueue_flags; @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) { if (q->flags & SIGQUEUE_PREALLOC) return; - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { - put_ucounts(q->ucounts); + if (q->ucounts) { + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); q->ucounts = NULL; } kmem_cache_free(sigqueue_cachep, q); diff --git a/kernel/ucount.c b/kernel/ucount.c index 3b7e176cf7a2..687d77aa66bb 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -285,6 +285,47 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) return (new == 0); } +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, + struct ucounts *last, enum ucount_type type) +{ + struct ucounts *iter; + for (iter = ucounts; iter != last; iter = iter->ns->ucounts) { + long dec = atomic_long_add_return(-1, &iter->ucount[type]); + WARN_ON_ONCE(dec < 0); + if (dec == 0) + put_ucounts(iter); + } +} + +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) +{ + do_dec_rlimit_put_ucounts(ucounts, NULL, type); +} + +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) +{ + struct ucounts *iter; + long dec, ret = 0; + + for (iter = ucounts; iter; iter = iter->ns->ucounts) { + long max = READ_ONCE(iter->ns->ucount_max[type]); + long new = atomic_long_add_return(1, &iter->ucount[type]); + if (new < 0 || new > max) + goto unwind; + else if (iter == ucounts) + ret = new; + if ((new == 1) && (get_ucounts(iter) != iter)) + goto dec_unwind; + } + return ret; +dec_unwind: + dec = atomic_long_add_return(1, &iter->ucount[type]); + WARN_ON_ONCE(dec < 0); +unwind: + do_dec_rlimit_put_ucounts(ucounts, iter, type); + return LONG_MAX; +} + bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) { struct ucounts *iter; -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-15 22:10 ` [CFT][PATCH] ucounts: Fix signal ucount refcounting Eric W. Biederman @ 2021-10-15 23:09 ` Alexey Gladkov 2021-10-16 17:34 ` Eric W. Biederman 2021-10-16 2:08 ` Hillf Danton ` (2 subsequent siblings) 3 siblings, 1 reply; 70+ messages in thread From: Alexey Gladkov @ 2021-10-15 23:09 UTC (permalink / raw) To: Eric W. Biederman Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers On Fri, Oct 15, 2021 at 05:10:58PM -0500, Eric W. Biederman wrote: > > In commit fda31c50292a ("signal: avoid double atomic counter > increments for user accounting") Linus made a clever optimization to > how rlimits and the struct user_struct. Unfortunately that > optimization does not work in the obvious way when moved to nested > rlimits. The problem is that the last decrement of the per user > namespace per user sigpending counter might also be the last decrement > of the sigpending counter in the parent user namespace as well. Which > means that simply freeing the leaf ucount in __free_sigqueue is not > enough. > > Maintain the optimization and handle the tricky cases by introducing > inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. > > By moving the entire optimization into functions that perform all of > the work it becomes possible to ensure that every level is handled > properly. > > I wish we had a single user across all of the threads whose rlimit > could be charged so we did not need this complexity. > > Cc: stable@vger.kernel.org > Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> > --- > > With a lot of help from Alex who found a way I could reproduce this > I believe I have found the issue. > > Could people who are seeing this issue test and verify this solves the > problem for them? > > include/linux/user_namespace.h | 2 ++ > kernel/signal.c | 25 +++++---------------- > kernel/ucount.c | 41 ++++++++++++++++++++++++++++++++++ > 3 files changed, 49 insertions(+), 19 deletions(-) > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index eb70cabe6e7f..33a4240e6a6f 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t > > long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); > +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); > bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); > > static inline void set_rlimit_ucount_max(struct user_namespace *ns, > diff --git a/kernel/signal.c b/kernel/signal.c > index a3229add4455..762de58c6e76 100644 > --- a/kernel/signal.c > +++ b/kernel/signal.c > @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > */ > rcu_read_lock(); > ucounts = task_ucounts(t); > - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > - switch (sigpending) { > - case 1: > - if (likely(get_ucounts(ucounts))) > - break; > - fallthrough; > - case LONG_MAX: > - /* > - * we need to decrease the ucount in the userns tree on any > - * failure to avoid counts leaking. > - */ > - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > - rcu_read_unlock(); > - return NULL; > - } > + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > rcu_read_unlock(); > + if (sigpending == LONG_MAX) > + return NULL; > > if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { > q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); > @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > } > > if (unlikely(q == NULL)) { > - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) > - put_ucounts(ucounts); > + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > } else { > INIT_LIST_HEAD(&q->list); > q->flags = sigqueue_flags; > @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) > { > if (q->flags & SIGQUEUE_PREALLOC) > return; > - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { > - put_ucounts(q->ucounts); > + if (q->ucounts) { > + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); > q->ucounts = NULL; > } > kmem_cache_free(sigqueue_cachep, q); > diff --git a/kernel/ucount.c b/kernel/ucount.c > index 3b7e176cf7a2..687d77aa66bb 100644 > --- a/kernel/ucount.c > +++ b/kernel/ucount.c > @@ -285,6 +285,47 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) > return (new == 0); > } > > +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, > + struct ucounts *last, enum ucount_type type) > +{ > + struct ucounts *iter; > + for (iter = ucounts; iter != last; iter = iter->ns->ucounts) { > + long dec = atomic_long_add_return(-1, &iter->ucount[type]); > + WARN_ON_ONCE(dec < 0); > + if (dec == 0) > + put_ucounts(iter); > + } > +} > + > +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) > +{ > + do_dec_rlimit_put_ucounts(ucounts, NULL, type); > +} > + > +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) > +{ > + struct ucounts *iter; > + long dec, ret = 0; > + > + for (iter = ucounts; iter; iter = iter->ns->ucounts) { > + long max = READ_ONCE(iter->ns->ucount_max[type]); > + long new = atomic_long_add_return(1, &iter->ucount[type]); > + if (new < 0 || new > max) > + goto unwind; > + else if (iter == ucounts) > + ret = new; > + if ((new == 1) && (get_ucounts(iter) != iter)) get_ucounts can do put_ucounts. Are you sure it's correct to use get_ucounts here? > + goto dec_unwind; > + } > + return ret; > +dec_unwind: > + dec = atomic_long_add_return(1, &iter->ucount[type]); Should be -1 ? > + WARN_ON_ONCE(dec < 0); > +unwind: > + do_dec_rlimit_put_ucounts(ucounts, iter, type); > + return LONG_MAX; > +} > + > bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) > { > struct ucounts *iter; > -- > 2.20.1 > -- Rgrds, legion ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-15 23:09 ` Alexey Gladkov @ 2021-10-16 17:34 ` Eric W. Biederman 2021-10-17 19:35 ` Yu Zhao 0 siblings, 1 reply; 70+ messages in thread From: Eric W. Biederman @ 2021-10-16 17:34 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers Alexey Gladkov <legion@kernel.org> writes: > On Fri, Oct 15, 2021 at 05:10:58PM -0500, Eric W. Biederman wrote: >> >> In commit fda31c50292a ("signal: avoid double atomic counter >> increments for user accounting") Linus made a clever optimization to >> how rlimits and the struct user_struct. Unfortunately that >> optimization does not work in the obvious way when moved to nested >> rlimits. The problem is that the last decrement of the per user >> namespace per user sigpending counter might also be the last decrement >> of the sigpending counter in the parent user namespace as well. Which >> means that simply freeing the leaf ucount in __free_sigqueue is not >> enough. >> >> Maintain the optimization and handle the tricky cases by introducing >> inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. >> >> By moving the entire optimization into functions that perform all of >> the work it becomes possible to ensure that every level is handled >> properly. >> >> I wish we had a single user across all of the threads whose rlimit >> could be charged so we did not need this complexity. >> >> Cc: stable@vger.kernel.org >> Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") >> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> >> --- >> >> With a lot of help from Alex who found a way I could reproduce this >> I believe I have found the issue. >> >> Could people who are seeing this issue test and verify this solves the >> problem for them? >> >> include/linux/user_namespace.h | 2 ++ >> kernel/signal.c | 25 +++++---------------- >> kernel/ucount.c | 41 ++++++++++++++++++++++++++++++++++ >> 3 files changed, 49 insertions(+), 19 deletions(-) >> >> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h >> index eb70cabe6e7f..33a4240e6a6f 100644 >> --- a/include/linux/user_namespace.h >> +++ b/include/linux/user_namespace.h >> @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t >> >> long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); >> bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); >> +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); >> +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); >> bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); >> >> static inline void set_rlimit_ucount_max(struct user_namespace *ns, >> diff --git a/kernel/signal.c b/kernel/signal.c >> index a3229add4455..762de58c6e76 100644 >> --- a/kernel/signal.c >> +++ b/kernel/signal.c >> @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, >> */ >> rcu_read_lock(); >> ucounts = task_ucounts(t); >> - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); >> - switch (sigpending) { >> - case 1: >> - if (likely(get_ucounts(ucounts))) >> - break; >> - fallthrough; >> - case LONG_MAX: >> - /* >> - * we need to decrease the ucount in the userns tree on any >> - * failure to avoid counts leaking. >> - */ >> - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); >> - rcu_read_unlock(); >> - return NULL; >> - } >> + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); >> rcu_read_unlock(); >> + if (sigpending == LONG_MAX) >> + return NULL; >> >> if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { >> q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); >> @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, >> } >> >> if (unlikely(q == NULL)) { >> - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) >> - put_ucounts(ucounts); >> + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); >> } else { >> INIT_LIST_HEAD(&q->list); >> q->flags = sigqueue_flags; >> @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) >> { >> if (q->flags & SIGQUEUE_PREALLOC) >> return; >> - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { >> - put_ucounts(q->ucounts); >> + if (q->ucounts) { >> + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); >> q->ucounts = NULL; >> } >> kmem_cache_free(sigqueue_cachep, q); >> diff --git a/kernel/ucount.c b/kernel/ucount.c >> index 3b7e176cf7a2..687d77aa66bb 100644 >> --- a/kernel/ucount.c >> +++ b/kernel/ucount.c >> @@ -285,6 +285,47 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) >> return (new == 0); >> } >> >> +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, >> + struct ucounts *last, enum ucount_type type) >> +{ >> + struct ucounts *iter; >> + for (iter = ucounts; iter != last; iter = iter->ns->ucounts) { >> + long dec = atomic_long_add_return(-1, &iter->ucount[type]); >> + WARN_ON_ONCE(dec < 0); >> + if (dec == 0) >> + put_ucounts(iter); >> + } >> +} >> + >> +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) >> +{ >> + do_dec_rlimit_put_ucounts(ucounts, NULL, type); >> +} >> + >> +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) >> +{ >> + struct ucounts *iter; >> + long dec, ret = 0; >> + >> + for (iter = ucounts; iter; iter = iter->ns->ucounts) { >> + long max = READ_ONCE(iter->ns->ucount_max[type]); >> + long new = atomic_long_add_return(1, &iter->ucount[type]); >> + if (new < 0 || new > max) >> + goto unwind; >> + else if (iter == ucounts) >> + ret = new; >> + if ((new == 1) && (get_ucounts(iter) != iter)) > > get_ucounts can do put_ucounts. Are you sure it's correct to use > get_ucounts here? My only concern would be if we could not run inc_rlimit_get_ucounts would not be safe to call under rcu_read_lock(). I don't see anything in get_ucounts or put_ucounts that would not be safe under rcu_read_lock(). For get_ucounts we do need to test to see if it fails. Either by testing for NULL or testing to see if it does not return the expected ucount. Does that make sense or do you have another concern? >> + goto dec_unwind; >> + } >> + return ret; >> +dec_unwind: >> + dec = atomic_long_add_return(1, &iter->ucount[type]); > > Should be -1 ? Yes it should. I will fix and resend. >> + WARN_ON_ONCE(dec < 0); >> +unwind: >> + do_dec_rlimit_put_ucounts(ucounts, iter, type); >> + return LONG_MAX; >> +} >> + >> bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) >> { >> struct ucounts *iter; >> -- >> 2.20.1 >> Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-16 17:34 ` Eric W. Biederman @ 2021-10-17 19:35 ` Yu Zhao 2021-10-18 15:35 ` Eric W. Biederman 0 siblings, 1 reply; 70+ messages in thread From: Yu Zhao @ 2021-10-17 19:35 UTC (permalink / raw) To: Eric W. Biederman Cc: Alexey Gladkov, Rune Kleveland, Jordan Glover, LKML, Linux-MM, containers\@lists.linux-foundation.org On Sat, Oct 16, 2021 at 11:35 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > Alexey Gladkov <legion@kernel.org> writes: > > > On Fri, Oct 15, 2021 at 05:10:58PM -0500, Eric W. Biederman wrote: > >> > >> In commit fda31c50292a ("signal: avoid double atomic counter > >> increments for user accounting") Linus made a clever optimization to > >> how rlimits and the struct user_struct. Unfortunately that > >> optimization does not work in the obvious way when moved to nested > >> rlimits. The problem is that the last decrement of the per user > >> namespace per user sigpending counter might also be the last decrement > >> of the sigpending counter in the parent user namespace as well. Which > >> means that simply freeing the leaf ucount in __free_sigqueue is not > >> enough. > >> > >> Maintain the optimization and handle the tricky cases by introducing > >> inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. > >> > >> By moving the entire optimization into functions that perform all of > >> the work it becomes possible to ensure that every level is handled > >> properly. > >> > >> I wish we had a single user across all of the threads whose rlimit > >> could be charged so we did not need this complexity. > >> > >> Cc: stable@vger.kernel.org > >> Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") > >> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> > >> --- > >> > >> With a lot of help from Alex who found a way I could reproduce this > >> I believe I have found the issue. > >> > >> Could people who are seeing this issue test and verify this solves the > >> problem for them? > >> > >> include/linux/user_namespace.h | 2 ++ > >> kernel/signal.c | 25 +++++---------------- > >> kernel/ucount.c | 41 ++++++++++++++++++++++++++++++++++ > >> 3 files changed, 49 insertions(+), 19 deletions(-) > >> > >> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > >> index eb70cabe6e7f..33a4240e6a6f 100644 > >> --- a/include/linux/user_namespace.h > >> +++ b/include/linux/user_namespace.h > >> @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t > >> > >> long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > >> bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > >> +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); > >> +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); > >> bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); > >> > >> static inline void set_rlimit_ucount_max(struct user_namespace *ns, > >> diff --git a/kernel/signal.c b/kernel/signal.c > >> index a3229add4455..762de58c6e76 100644 > >> --- a/kernel/signal.c > >> +++ b/kernel/signal.c > >> @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > >> */ > >> rcu_read_lock(); > >> ucounts = task_ucounts(t); > >> - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > >> - switch (sigpending) { > >> - case 1: > >> - if (likely(get_ucounts(ucounts))) > >> - break; > >> - fallthrough; > >> - case LONG_MAX: > >> - /* > >> - * we need to decrease the ucount in the userns tree on any > >> - * failure to avoid counts leaking. > >> - */ > >> - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > >> - rcu_read_unlock(); > >> - return NULL; > >> - } > >> + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > >> rcu_read_unlock(); > >> + if (sigpending == LONG_MAX) > >> + return NULL; > >> > >> if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { > >> q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); > >> @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > >> } > >> > >> if (unlikely(q == NULL)) { > >> - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) > >> - put_ucounts(ucounts); > >> + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > >> } else { > >> INIT_LIST_HEAD(&q->list); > >> q->flags = sigqueue_flags; > >> @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) > >> { > >> if (q->flags & SIGQUEUE_PREALLOC) > >> return; > >> - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { > >> - put_ucounts(q->ucounts); > >> + if (q->ucounts) { > >> + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); > >> q->ucounts = NULL; > >> } > >> kmem_cache_free(sigqueue_cachep, q); > >> diff --git a/kernel/ucount.c b/kernel/ucount.c > >> index 3b7e176cf7a2..687d77aa66bb 100644 > >> --- a/kernel/ucount.c > >> +++ b/kernel/ucount.c > >> @@ -285,6 +285,47 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) > >> return (new == 0); > >> } > >> > >> +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, > >> + struct ucounts *last, enum ucount_type type) > >> +{ > >> + struct ucounts *iter; > >> + for (iter = ucounts; iter != last; iter = iter->ns->ucounts) { > >> + long dec = atomic_long_add_return(-1, &iter->ucount[type]); > >> + WARN_ON_ONCE(dec < 0); > >> + if (dec == 0) > >> + put_ucounts(iter); > >> + } > >> +} > >> + > >> +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) > >> +{ > >> + do_dec_rlimit_put_ucounts(ucounts, NULL, type); > >> +} > >> + > >> +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) > >> +{ > >> + struct ucounts *iter; > >> + long dec, ret = 0; > >> + > >> + for (iter = ucounts; iter; iter = iter->ns->ucounts) { > >> + long max = READ_ONCE(iter->ns->ucount_max[type]); > >> + long new = atomic_long_add_return(1, &iter->ucount[type]); > >> + if (new < 0 || new > max) > >> + goto unwind; > >> + else if (iter == ucounts) > >> + ret = new; > >> + if ((new == 1) && (get_ucounts(iter) != iter)) > > > > get_ucounts can do put_ucounts. Are you sure it's correct to use > > get_ucounts here? > > My only concern would be if we could not run inc_rlimit_get_ucounts > would not be safe to call under rcu_read_lock(). I don't see anything > in get_ucounts or put_ucounts that would not be safe under > rcu_read_lock(). > > For get_ucounts we do need to test to see if it fails. Either by > testing for NULL or testing to see if it does not return the expected > ucount. > > Does that make sense or do you have another concern? > > > >> + goto dec_unwind; > >> + } > >> + return ret; > >> +dec_unwind: > >> + dec = atomic_long_add_return(1, &iter->ucount[type]); > > > > Should be -1 ? > > Yes it should. I will fix and resend. Or just atomic_long_dec_return(). > >> + WARN_ON_ONCE(dec < 0); > >> +unwind: > >> + do_dec_rlimit_put_ucounts(ucounts, iter, type); > >> + return LONG_MAX; > >> +} > >> + > >> bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) > >> { > >> struct ucounts *iter; > >> -- > >> 2.20.1 > >> > > Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-17 19:35 ` Yu Zhao @ 2021-10-18 15:35 ` Eric W. Biederman 0 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 15:35 UTC (permalink / raw) To: Yu Zhao Cc: Alexey Gladkov, Rune Kleveland, Jordan Glover, LKML, Linux-MM, containers Yu Zhao <yuzhao@google.com> writes: > On Sat, Oct 16, 2021 at 11:35 AM Eric W. Biederman > <ebiederm@xmission.com> wrote: >> >> Alexey Gladkov <legion@kernel.org> writes: >> >> > On Fri, Oct 15, 2021 at 05:10:58PM -0500, Eric W. Biederman wrote: >> >> + goto dec_unwind; >> >> + } >> >> + return ret; >> >> +dec_unwind: >> >> + dec = atomic_long_add_return(1, &iter->ucount[type]); >> > >> > Should be -1 ? >> >> Yes it should. I will fix and resend. > > Or just atomic_long_dec_return(). It would have to be atomic_long_sub_return(). Even then I would want to change all of kernel/ucount.c to use the same helper function so discrepancies can easily be spotted. It is a good idea, just not I think for this particular patch. Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-15 22:10 ` [CFT][PATCH] ucounts: Fix signal ucount refcounting Eric W. Biederman 2021-10-15 23:09 ` Alexey Gladkov @ 2021-10-16 2:08 ` Hillf Danton 2021-10-16 18:00 ` Eric W. Biederman 2021-10-17 16:47 ` Rune Kleveland 2021-10-18 16:06 ` [PATCH v2] " Eric W. Biederman 3 siblings, 1 reply; 70+ messages in thread From: Hillf Danton @ 2021-10-16 2:08 UTC (permalink / raw) To: Eric W . Biederman Cc: Rune Kleveland, Yu Zhao, Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers On Fri, 15 Oct 2021 17:10:58 -0500 Eric W. Biederman wrote: > > In commit fda31c50292a ("signal: avoid double atomic counter > increments for user accounting") Linus made a clever optimization to > how rlimits and the struct user_struct. Unfortunately that > optimization does not work in the obvious way when moved to nested > rlimits. The problem is that the last decrement of the per user > namespace per user sigpending counter might also be the last decrement > of the sigpending counter in the parent user namespace as well. Which > means that simply freeing the leaf ucount in __free_sigqueue is not > enough. > > Maintain the optimization and handle the tricky cases by introducing > inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. > > By moving the entire optimization into functions that perform all of > the work it becomes possible to ensure that every level is handled > properly. > > I wish we had a single user across all of the threads whose rlimit > could be charged so we did not need this complexity. > > Cc: stable@vger.kernel.org > Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> > --- > > With a lot of help from Alex who found a way I could reproduce this > I believe I have found the issue. > > Could people who are seeing this issue test and verify this solves the > problem for them? > > include/linux/user_namespace.h | 2 ++ > kernel/signal.c | 25 +++++---------------- > kernel/ucount.c | 41 ++++++++++++++++++++++++++++++++++ > 3 files changed, 49 insertions(+), 19 deletions(-) > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index eb70cabe6e7f..33a4240e6a6f 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t > > long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); > +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); > bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); > > static inline void set_rlimit_ucount_max(struct user_namespace *ns, > diff --git a/kernel/signal.c b/kernel/signal.c > index a3229add4455..762de58c6e76 100644 > --- a/kernel/signal.c > +++ b/kernel/signal.c > @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > */ > rcu_read_lock(); > ucounts = task_ucounts(t); > - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > - switch (sigpending) { > - case 1: > - if (likely(get_ucounts(ucounts))) > - break; > - fallthrough; > - case LONG_MAX: > - /* > - * we need to decrease the ucount in the userns tree on any > - * failure to avoid counts leaking. > - */ > - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > - rcu_read_unlock(); > - return NULL; > - } > + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > rcu_read_unlock(); > + if (sigpending == LONG_MAX) > + return NULL; > > if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { > q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); > @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > } > > if (unlikely(q == NULL)) { > - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) > - put_ucounts(ucounts); > + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > } else { > INIT_LIST_HEAD(&q->list); > q->flags = sigqueue_flags; > @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) > { > if (q->flags & SIGQUEUE_PREALLOC) > return; > - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { > - put_ucounts(q->ucounts); > + if (q->ucounts) { > + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); > q->ucounts = NULL; > } > kmem_cache_free(sigqueue_cachep, q); > diff --git a/kernel/ucount.c b/kernel/ucount.c > index 3b7e176cf7a2..687d77aa66bb 100644 > --- a/kernel/ucount.c > +++ b/kernel/ucount.c > @@ -285,6 +285,47 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) > return (new == 0); > } > > +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, > + struct ucounts *last, enum ucount_type type) > +{ > + struct ucounts *iter; > + for (iter = ucounts; iter != last; iter = iter->ns->ucounts) { > + long dec = atomic_long_add_return(-1, &iter->ucount[type]); > + WARN_ON_ONCE(dec < 0); > + if (dec == 0) > + put_ucounts(iter); > + } Given kfree in put_ucounts(), this has difficulty surviving tests like kasan if the put pairs with the get in the below inc_rlimit_get_ucounts(). > +} > + > +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) > +{ > + do_dec_rlimit_put_ucounts(ucounts, NULL, type); > +} > + > +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) > +{ > + struct ucounts *iter; > + long dec, ret = 0; > + > + for (iter = ucounts; iter; iter = iter->ns->ucounts) { > + long max = READ_ONCE(iter->ns->ucount_max[type]); > + long new = atomic_long_add_return(1, &iter->ucount[type]); > + if (new < 0 || new > max) > + goto unwind; > + else if (iter == ucounts) > + ret = new; > + if ((new == 1) && (get_ucounts(iter) != iter)) > + goto dec_unwind; Add a line of comment for get to ease readers. Hillf > + } > + return ret; > +dec_unwind: > + dec = atomic_long_add_return(1, &iter->ucount[type]); > + WARN_ON_ONCE(dec < 0); > +unwind: > + do_dec_rlimit_put_ucounts(ucounts, iter, type); > + return LONG_MAX; > +} > + > bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) > { > struct ucounts *iter; > -- > 2.20.1 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-16 2:08 ` Hillf Danton @ 2021-10-16 18:00 ` Eric W. Biederman 0 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-16 18:00 UTC (permalink / raw) To: Hillf Danton Cc: Rune Kleveland, Yu Zhao, Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers Hillf Danton <hdanton@sina.com> writes: > On Fri, 15 Oct 2021 17:10:58 -0500 Eric W. Biederman wrote: >> >> In commit fda31c50292a ("signal: avoid double atomic counter >> increments for user accounting") Linus made a clever optimization to >> how rlimits and the struct user_struct. Unfortunately that >> optimization does not work in the obvious way when moved to nested >> rlimits. The problem is that the last decrement of the per user >> namespace per user sigpending counter might also be the last decrement >> of the sigpending counter in the parent user namespace as well. Which >> means that simply freeing the leaf ucount in __free_sigqueue is not >> enough. >> >> Maintain the optimization and handle the tricky cases by introducing >> inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. >> >> By moving the entire optimization into functions that perform all of >> the work it becomes possible to ensure that every level is handled >> properly. >> >> I wish we had a single user across all of the threads whose rlimit >> could be charged so we did not need this complexity. >> >> Cc: stable@vger.kernel.org >> Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") >> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> >> --- >> >> With a lot of help from Alex who found a way I could reproduce this >> I believe I have found the issue. >> >> Could people who are seeing this issue test and verify this solves the >> problem for them? >> >> include/linux/user_namespace.h | 2 ++ >> kernel/signal.c | 25 +++++---------------- >> kernel/ucount.c | 41 ++++++++++++++++++++++++++++++++++ >> 3 files changed, 49 insertions(+), 19 deletions(-) >> >> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h >> index eb70cabe6e7f..33a4240e6a6f 100644 >> --- a/include/linux/user_namespace.h >> +++ b/include/linux/user_namespace.h >> @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t >> >> long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); >> bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); >> +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); >> +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); >> bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); >> >> static inline void set_rlimit_ucount_max(struct user_namespace *ns, >> diff --git a/kernel/signal.c b/kernel/signal.c >> index a3229add4455..762de58c6e76 100644 >> --- a/kernel/signal.c >> +++ b/kernel/signal.c >> @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, >> */ >> rcu_read_lock(); >> ucounts = task_ucounts(t); >> - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); >> - switch (sigpending) { >> - case 1: >> - if (likely(get_ucounts(ucounts))) >> - break; >> - fallthrough; >> - case LONG_MAX: >> - /* >> - * we need to decrease the ucount in the userns tree on any >> - * failure to avoid counts leaking. >> - */ >> - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); >> - rcu_read_unlock(); >> - return NULL; >> - } >> + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); >> rcu_read_unlock(); >> + if (sigpending == LONG_MAX) >> + return NULL; >> >> if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { >> q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); >> @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, >> } >> >> if (unlikely(q == NULL)) { >> - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) >> - put_ucounts(ucounts); >> + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); >> } else { >> INIT_LIST_HEAD(&q->list); >> q->flags = sigqueue_flags; >> @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) >> { >> if (q->flags & SIGQUEUE_PREALLOC) >> return; >> - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { >> - put_ucounts(q->ucounts); >> + if (q->ucounts) { >> + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); >> q->ucounts = NULL; >> } >> kmem_cache_free(sigqueue_cachep, q); >> diff --git a/kernel/ucount.c b/kernel/ucount.c >> index 3b7e176cf7a2..687d77aa66bb 100644 >> --- a/kernel/ucount.c >> +++ b/kernel/ucount.c >> @@ -285,6 +285,47 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) >> return (new == 0); >> } >> >> +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, >> + struct ucounts *last, enum ucount_type type) >> +{ >> + struct ucounts *iter; >> + for (iter = ucounts; iter != last; iter = iter->ns->ucounts) { >> + long dec = atomic_long_add_return(-1, &iter->ucount[type]); >> + WARN_ON_ONCE(dec < 0); >> + if (dec == 0) >> + put_ucounts(iter); >> + } > > Given kfree in put_ucounts(), this has difficulty surviving tests like > kasan if the put pairs with the get in the below > inc_rlimit_get_ucounts(). I don't know if this is what you are thinking about but there is indeed a bug in that loop caused by kfree. The problem is that iter->ns->ucounts is read after put_ucounts. It just needs to be read before hand. >> +} >> + >> +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) >> +{ >> + do_dec_rlimit_put_ucounts(ucounts, NULL, type); >> +} >> + >> +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) >> +{ >> + struct ucounts *iter; >> + long dec, ret = 0; >> + >> + for (iter = ucounts; iter; iter = iter->ns->ucounts) { >> + long max = READ_ONCE(iter->ns->ucount_max[type]); >> + long new = atomic_long_add_return(1, &iter->ucount[type]); >> + if (new < 0 || new > max) >> + goto unwind; >> + else if (iter == ucounts) >> + ret = new; >> + if ((new == 1) && (get_ucounts(iter) != iter)) >> + goto dec_unwind; > > Add a line of comment for get to ease readers. /* you are not expected to understand this */ I think that is the classic comment from unix source. Seriously I can't think of any comment that will make the situation more comprehensible. > Hillf > >> + } >> + return ret; >> +dec_unwind: >> + dec = atomic_long_add_return(1, &iter->ucount[type]); >> + WARN_ON_ONCE(dec < 0); >> +unwind: >> + do_dec_rlimit_put_ucounts(ucounts, iter, type); >> + return LONG_MAX; >> +} >> + >> bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) >> { >> struct ucounts *iter; >> -- >> 2.20.1 Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-15 22:10 ` [CFT][PATCH] ucounts: Fix signal ucount refcounting Eric W. Biederman 2021-10-15 23:09 ` Alexey Gladkov 2021-10-16 2:08 ` Hillf Danton @ 2021-10-17 16:47 ` Rune Kleveland 2021-10-18 6:25 ` Yu Zhao 2021-10-18 16:06 ` [PATCH v2] " Eric W. Biederman 3 siblings, 1 reply; 70+ messages in thread From: Rune Kleveland @ 2021-10-17 16:47 UTC (permalink / raw) To: Eric W. Biederman Cc: Yu Zhao, Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers Hi! After applying the below patch, the 5 most problematic servers have run without any issues for 23 hours. That never happened before the patch on 5.14, so the patch seems to have fixed the issue for me. On Monday there will be more load on the servers, which caused them to crash faster without the patch. I will let you know if it happens again. Best regards, Rune On 16/10/2021 00:10, Eric W. Biederman wrote: > > In commit fda31c50292a ("signal: avoid double atomic counter > increments for user accounting") Linus made a clever optimization to > how rlimits and the struct user_struct. Unfortunately that > optimization does not work in the obvious way when moved to nested > rlimits. The problem is that the last decrement of the per user > namespace per user sigpending counter might also be the last decrement > of the sigpending counter in the parent user namespace as well. Which > means that simply freeing the leaf ucount in __free_sigqueue is not > enough. > > Maintain the optimization and handle the tricky cases by introducing > inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. > > By moving the entire optimization into functions that perform all of > the work it becomes possible to ensure that every level is handled > properly. > > I wish we had a single user across all of the threads whose rlimit > could be charged so we did not need this complexity. ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-17 16:47 ` Rune Kleveland @ 2021-10-18 6:25 ` Yu Zhao 2021-10-18 10:31 ` Jordan Glover 0 siblings, 1 reply; 70+ messages in thread From: Yu Zhao @ 2021-10-18 6:25 UTC (permalink / raw) To: Rune Kleveland, Eric W. Biederman Cc: Alexey Gladkov, Jordan Glover, LKML, Linux-MM, containers\@lists.linux-foundation.org On Sun, Oct 17, 2021 at 10:47 AM Rune Kleveland <rune.kleveland@infomedia.dk> wrote: > > Hi! > > After applying the below patch, the 5 most problematic servers have run > without any issues for 23 hours. That never happened before the patch on > 5.14, so the patch seems to have fixed the issue for me. Confirm. I couldn't reproduce the problem on 5.14 either. > On Monday there will be more load on the servers, which caused them to > crash faster without the patch. I will let you know if it happens again. > > Best regards, > Rune > > On 16/10/2021 00:10, Eric W. Biederman wrote: > > > > In commit fda31c50292a ("signal: avoid double atomic counter > > increments for user accounting") Linus made a clever optimization to > > how rlimits and the struct user_struct. Unfortunately that > > optimization does not work in the obvious way when moved to nested > > rlimits. The problem is that the last decrement of the per user > > namespace per user sigpending counter might also be the last decrement > > of the sigpending counter in the parent user namespace as well. Which > > means that simply freeing the leaf ucount in __free_sigqueue is not > > enough. > > > > Maintain the optimization and handle the tricky cases by introducing > > inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. > > > > By moving the entire optimization into functions that perform all of > > the work it becomes possible to ensure that every level is handled > > properly. > > > > I wish we had a single user across all of the threads whose rlimit > > could be charged so we did not need this complexity. ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [CFT][PATCH] ucounts: Fix signal ucount refcounting 2021-10-18 6:25 ` Yu Zhao @ 2021-10-18 10:31 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-10-18 10:31 UTC (permalink / raw) To: Yu Zhao Cc: Rune Kleveland, Eric W. Biederman, Alexey Gladkov, LKML, Linux-MM, containers\\@lists.linux-foundation.org On Monday, October 18th, 2021 at 6:25 AM, Yu Zhao <yuzhao@google.com> wrote: > On Sun, Oct 17, 2021 at 10:47 AM Rune Kleveland > > rune.kleveland@infomedia.dk wrote: > > > Hi! > > > > After applying the below patch, the 5 most problematic servers have run > > > > without any issues for 23 hours. That never happened before the patch on > > > > 5.14, so the patch seems to have fixed the issue for me. > > Confirm. I couldn't reproduce the problem on 5.14 either. > I'm also unable to reproduce the crash as for now. Thx for the patch. Jordan > > On Monday there will be more load on the servers, which caused them to > > > > crash faster without the patch. I will let you know if it happens again. > > > > Best regards, > > > > Rune > > > > On 16/10/2021 00:10, Eric W. Biederman wrote: > > > > > In commit fda31c50292a ("signal: avoid double atomic counter > > > > > > increments for user accounting") Linus made a clever optimization to > > > > > > how rlimits and the struct user_struct. Unfortunately that > > > > > > optimization does not work in the obvious way when moved to nested > > > > > > rlimits. The problem is that the last decrement of the per user > > > > > > namespace per user sigpending counter might also be the last decrement > > > > > > of the sigpending counter in the parent user namespace as well. Which > > > > > > means that simply freeing the leaf ucount in __free_sigqueue is not > > > > > > enough. > > > > > > Maintain the optimization and handle the tricky cases by introducing > > > > > > inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. > > > > > > By moving the entire optimization into functions that perform all of > > > > > > the work it becomes possible to ensure that every level is handled > > > > > > properly. > > > > > > I wish we had a single user across all of the threads whose rlimit > > > > > > could be charged so we did not need this complexity. ^ permalink raw reply [flat|nested] 70+ messages in thread
* [PATCH v2] ucounts: Fix signal ucount refcounting 2021-10-15 22:10 ` [CFT][PATCH] ucounts: Fix signal ucount refcounting Eric W. Biederman ` (2 preceding siblings ...) 2021-10-17 16:47 ` Rune Kleveland @ 2021-10-18 16:06 ` Eric W. Biederman 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman 2021-10-18 22:26 ` [PATCH v2] ucounts: Fix signal ucount refcounting Yu Zhao 3 siblings, 2 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 16:06 UTC (permalink / raw) To: Rune Kleveland Cc: Yu Zhao, Alexey Gladkov, Jordan Glover, LKML, linux-mm, containers, Hillf Danton In commit fda31c50292a ("signal: avoid double atomic counter increments for user accounting") Linus made a clever optimization to how rlimits and the struct user_struct. Unfortunately that optimization does not work in the obvious way when moved to nested rlimits. The problem is that the last decrement of the per user namespace per user sigpending counter might also be the last decrement of the sigpending counter in the parent user namespace as well. Which means that simply freeing the leaf ucount in __free_sigqueue is not enough. Maintain the optimization and handle the tricky cases by introducing inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. By moving the entire optimization into functions that perform all of the work it becomes possible to ensure that every level is handled properly. The new function inc_rlimit_get_ucounts returns 0 on failure to increment the ucount. This is different than inc_rlimit_ucounts which increments the ucounts and returns LONG_MAX if the ucount counter has exceeded it's maximum or it wrapped (to indicate the counter needs to decremented). I wish we had a single user to account all pending signals to across all of the threads of a process so this complexity was not necessary Cc: stable@vger.kernel.org Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") v1: https://lkml.kernel.org/r/87mtnavszx.fsf_-_@disp2133 Tested-by: Rune Kleveland <rune.kleveland@infomedia.dk> Tested-by: Yu Zhao <yuzhao@google.com> Tested-by: Jordan Glover <Golden_Miller83@protonmail.ch> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- This is my version of the fix with all of the feedback rolled in. I have tested it and believe this is ready to send out. If folks code take a once over and see if I have spotted things. For the people who are testing or have tested this I have added your tested-by's please let me know if you mind. Eric include/linux/user_namespace.h | 2 ++ kernel/signal.c | 25 +++++------------ kernel/ucount.c | 49 ++++++++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+), 19 deletions(-) diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index eb70cabe6e7f..33a4240e6a6f 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); static inline void set_rlimit_ucount_max(struct user_namespace *ns, diff --git a/kernel/signal.c b/kernel/signal.c index a3229add4455..13d2505a14a0 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, */ rcu_read_lock(); ucounts = task_ucounts(t); - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); - switch (sigpending) { - case 1: - if (likely(get_ucounts(ucounts))) - break; - fallthrough; - case LONG_MAX: - /* - * we need to decrease the ucount in the userns tree on any - * failure to avoid counts leaking. - */ - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); - rcu_read_unlock(); - return NULL; - } + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); rcu_read_unlock(); + if (!sigpending) + return NULL; if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, } if (unlikely(q == NULL)) { - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) - put_ucounts(ucounts); + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); } else { INIT_LIST_HEAD(&q->list); q->flags = sigqueue_flags; @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) { if (q->flags & SIGQUEUE_PREALLOC) return; - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { - put_ucounts(q->ucounts); + if (q->ucounts) { + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); q->ucounts = NULL; } kmem_cache_free(sigqueue_cachep, q); diff --git a/kernel/ucount.c b/kernel/ucount.c index bb51849e6375..eb03f3c68375 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -284,6 +284,55 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) return (new == 0); } +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, + struct ucounts *last, enum ucount_type type) +{ + struct ucounts *iter, *next; + for (iter = ucounts; iter != last; iter = next) { + long dec = atomic_long_add_return(-1, &iter->ucount[type]); + WARN_ON_ONCE(dec < 0); + next = iter->ns->ucounts; + if (dec == 0) + put_ucounts(iter); + } +} + +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) +{ + do_dec_rlimit_put_ucounts(ucounts, NULL, type); +} + +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) +{ + /* Caller must hold a reference to ucounts */ + struct ucounts *iter; + long dec, ret = 0; + + for (iter = ucounts; iter; iter = iter->ns->ucounts) { + long max = READ_ONCE(iter->ns->ucount_max[type]); + long new = atomic_long_add_return(1, &iter->ucount[type]); + if (new < 0 || new > max) + goto unwind; + if (iter == ucounts) + ret = new; + /* + * Grab an extra ucount reference for the caller when + * the rlimit count was previously 0. + */ + if (new != 1) + continue; + if (!get_ucounts(iter)) + goto dec_unwind; + } + return ret; +dec_unwind: + dec = atomic_long_add_return(-1, &iter->ucount[type]); + WARN_ON_ONCE(dec < 0); +unwind: + do_dec_rlimit_put_ucounts(ucounts, iter, type); + return 0; +} + bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) { struct ucounts *iter; -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* [PATCH 0/3] ucounts: misc fixes 2021-10-18 16:06 ` [PATCH v2] " Eric W. Biederman @ 2021-10-18 17:21 ` Eric W. Biederman 2021-10-18 17:23 ` [PATCH 1/3] ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds Eric W. Biederman ` (4 more replies) 2021-10-18 22:26 ` [PATCH v2] ucounts: Fix signal ucount refcounting Yu Zhao 1 sibling, 5 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:21 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton, David Howells, Jarkko Sakkinen While digging into the previous ucount kernel crashes I found some minor bugs in the ucount code. When hit these bugs all result in a ucount either being counted in the wrong location or leak of a struct ucounts. Nothing particularly serious but certainly things that should be fixed. Eric W. Biederman (3): ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds ucounts: Proper error handling in set_cred_ucounts ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring kernel/cred.c | 9 ++++----- security/keys/process_keys.c | 8 ++++++++ 2 files changed, 12 insertions(+), 5 deletions(-) Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* [PATCH 1/3] ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman @ 2021-10-18 17:23 ` Eric W. Biederman 2021-10-18 17:23 ` [PATCH 2/3] ucounts: Proper error handling in set_cred_ucounts Eric W. Biederman ` (3 subsequent siblings) 4 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:23 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton, David Howells, Jarkko Sakkinen The purpose of inc_rlimit_ucounts and dec_rlimit_ucounts in commit_creds is to change which rlimit counter is used to track a process when the credentials changes. Use the same test for both to guarantee the tracking is correct. Cc: stable@vger.kernel.org Fixes: 21d1c5e386bc ("Reimplement RLIMIT_NPROC on top of ucounts") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/cred.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/cred.c b/kernel/cred.c index f784e08c2fbd..3d163bfd64a9 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -501,7 +501,7 @@ int commit_creds(struct cred *new) inc_rlimit_ucounts(new->ucounts, UCOUNT_RLIMIT_NPROC, 1); rcu_assign_pointer(task->real_cred, new); rcu_assign_pointer(task->cred, new); - if (new->user != old->user) + if (new->user != old->user || new->user_ns != old->user_ns) dec_rlimit_ucounts(old->ucounts, UCOUNT_RLIMIT_NPROC, 1); alter_cred_subscribers(old, -2); -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* [PATCH 2/3] ucounts: Proper error handling in set_cred_ucounts 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman 2021-10-18 17:23 ` [PATCH 1/3] ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds Eric W. Biederman @ 2021-10-18 17:23 ` Eric W. Biederman 2021-10-18 17:24 ` [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring Eric W. Biederman ` (2 subsequent siblings) 4 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:23 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton, David Howells, Jarkko Sakkinen Instead of leaking the ucounts in new if alloc_ucounts fails, store the result of alloc_ucounts into a temporary variable, which is later assigned to new->ucounts. Cc: stable@vger.kernel.org Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/cred.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/cred.c b/kernel/cred.c index 3d163bfd64a9..16c05dfbec4d 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -669,7 +669,7 @@ int set_cred_ucounts(struct cred *new) { struct task_struct *task = current; const struct cred *old = task->real_cred; - struct ucounts *old_ucounts = new->ucounts; + struct ucounts *new_ucounts, *old_ucounts = new->ucounts; if (new->user == old->user && new->user_ns == old->user_ns) return 0; @@ -681,9 +681,10 @@ int set_cred_ucounts(struct cred *new) if (old_ucounts && old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid)) return 0; - if (!(new->ucounts = alloc_ucounts(new->user_ns, new->euid))) + if (!(new_ucounts = alloc_ucounts(new->user_ns, new->euid))) return -EAGAIN; + new->ucounts = new_ucounts; if (old_ucounts) put_ucounts(old_ucounts); -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman 2021-10-18 17:23 ` [PATCH 1/3] ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds Eric W. Biederman 2021-10-18 17:23 ` [PATCH 2/3] ucounts: Proper error handling in set_cred_ucounts Eric W. Biederman @ 2021-10-18 17:24 ` Eric W. Biederman 2021-10-24 17:36 ` kernel test robot ` (2 more replies) 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman 2021-10-18 22:28 ` [PATCH 0/3] ucounts: misc fixes Yu Zhao 4 siblings, 3 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:24 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton, David Howells, Jarkko Sakkinen Setting cred->ucounts in cred_alloc_blank does not make sense. The uid and user_ns are deliberately not set in cred_alloc_blank but instead the setting is delayed until key_change_session_keyring. So move dealing with ucounts into key_change_session_keyring as well. Unfortunately that movement of get_ucounts adds a new failure mode to key_change_session_keyring. I do not see anything stopping the parent process from calling setuid and changing the relevant part of it's cred while keyctl_session_to_parent is running making it fundamentally necessary to call get_ucounts in key_change_session_keyring. Which means that the new failure mode cannot be avoided. A failure of key_change_session_keyring results in a single threaded parent keeping it's existing credentials. Which results in the parent process not being able to access the session keyring and whichever keys are in the new keyring. Further get_ucounts is only expected to fail if the number of bits in the refernece count for the structure is too few. Since the code has no other way to report the failure of get_ucounts and because such failures are not expected to be common add a WARN_ONCE to report this problem to userspace. Between the WARN_ONCE and the parent process not having access to the keys in the new session keyring I expect any failure of get_ucounts will be noticed and reported and we can find another way to handle this condition. (Possibly by just making ucounts->count an atomic_long_t). Cc: stable@vger.kernel.org Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/cred.c | 2 -- security/keys/process_keys.c | 8 ++++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/cred.c b/kernel/cred.c index 16c05dfbec4d..1ae0b4948a5a 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -225,8 +225,6 @@ struct cred *cred_alloc_blank(void) #ifdef CONFIG_DEBUG_CREDENTIALS new->magic = CRED_MAGIC; #endif - new->ucounts = get_ucounts(&init_ucounts); - if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0) goto error; diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c index e3d79a7b6db6..20cc5a9a05fd 100644 --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -918,6 +918,13 @@ void key_change_session_keyring(struct callback_head *twork) return; } + /* If get_ucounts fails more bits are needed in the refcount */ + if (unlikely(!get_ucounts(old->ucounts))) { + WARN_ONCE(1, "In %s get_ucounts failed\n"); + put_cred(new); + return; + } + new-> uid = old-> uid; new-> euid = old-> euid; new-> suid = old-> suid; @@ -927,6 +934,7 @@ void key_change_session_keyring(struct callback_head *twork) new-> sgid = old-> sgid; new->fsgid = old->fsgid; new->user = get_uid(old->user); + new->ucounts = old->ucounts; new->user_ns = get_user_ns(old->user_ns); new->group_info = get_group_info(old->group_info); -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* Re: [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring 2021-10-18 17:24 ` [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring Eric W. Biederman @ 2021-10-24 17:36 ` kernel test robot 2021-10-25 14:13 ` Eric W. Biederman 2021-11-06 5:05 ` kernel test robot 2021-11-06 20:22 ` kernel test robot 2 siblings, 1 reply; 70+ messages in thread From: kernel test robot @ 2021-10-24 17:36 UTC (permalink / raw) To: kbuild-all [-- Attachment #1: Type: text/plain, Size: 5689 bytes --] Hi "Eric, Thank you for the patch! Yet something to improve: [auto build test ERROR on linux/master] [also build test ERROR on v5.15-rc6] [cannot apply to linus/master jmorris-security/next-testing next-20211022] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ec681c53f8d2d0ee362ff67f5b98dd8263c15002 config: arc-allyesconfig (attached as .config) compiler: arceb-elf-gcc (GCC) 11.2.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/0day-ci/linux/commit/78e52b4abddecd7a6666f768874ee737c292830d git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 git checkout 78e52b4abddecd7a6666f768874ee737c292830d # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=arc If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@intel.com> All errors (new ones prefixed by >>): In file included from arch/arc/include/asm/bug.h:30, from include/linux/bug.h:5, from include/linux/thread_info.h:13, from include/asm-generic/preempt.h:5, from ./arch/arc/include/generated/asm/preempt.h:1, from include/linux/preempt.h:78, from include/linux/rcupdate.h:27, from include/linux/rculist.h:11, from include/linux/pid.h:5, from include/linux/sched.h:14, from security/keys/process_keys.c:9: security/keys/process_keys.c: In function 'key_change_session_keyring': >> security/keys/process_keys.c:923:30: error: format '%s' expects a matching 'char *' argument [-Werror=format=] 923 | WARN_ONCE(1, "In %s get_ucounts failed\n"); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:91:62: note: in definition of macro '__WARN_printf' 91 | warn_slowpath_fmt(__FILE__, __LINE__, taint, arg); \ | ^~~ include/linux/once_lite.h:19:25: note: in expansion of macro 'WARN' 19 | func(__VA_ARGS__); \ | ^~~~ include/asm-generic/bug.h:150:9: note: in expansion of macro 'DO_ONCE_LITE_IF' 150 | DO_ONCE_LITE_IF(condition, WARN, 1, format) | ^~~~~~~~~~~~~~~ security/keys/process_keys.c:923:17: note: in expansion of macro 'WARN_ONCE' 923 | WARN_ONCE(1, "In %s get_ucounts failed\n"); | ^~~~~~~~~ security/keys/process_keys.c:923:35: note: format string is defined here 923 | WARN_ONCE(1, "In %s get_ucounts failed\n"); | ~^ | | | char * cc1: all warnings being treated as errors vim +923 security/keys/process_keys.c 906 907 /* 908 * Replace a process's session keyring on behalf of one of its children when 909 * the target process is about to resume userspace execution. 910 */ 911 void key_change_session_keyring(struct callback_head *twork) 912 { 913 const struct cred *old = current_cred(); 914 struct cred *new = container_of(twork, struct cred, rcu); 915 916 if (unlikely(current->flags & PF_EXITING)) { 917 put_cred(new); 918 return; 919 } 920 921 /* If get_ucounts fails more bits are needed in the refcount */ 922 if (unlikely(!get_ucounts(old->ucounts))) { > 923 WARN_ONCE(1, "In %s get_ucounts failed\n"); 924 put_cred(new); 925 return; 926 } 927 928 new-> uid = old-> uid; 929 new-> euid = old-> euid; 930 new-> suid = old-> suid; 931 new->fsuid = old->fsuid; 932 new-> gid = old-> gid; 933 new-> egid = old-> egid; 934 new-> sgid = old-> sgid; 935 new->fsgid = old->fsgid; 936 new->user = get_uid(old->user); 937 new->ucounts = old->ucounts; 938 new->user_ns = get_user_ns(old->user_ns); 939 new->group_info = get_group_info(old->group_info); 940 941 new->securebits = old->securebits; 942 new->cap_inheritable = old->cap_inheritable; 943 new->cap_permitted = old->cap_permitted; 944 new->cap_effective = old->cap_effective; 945 new->cap_ambient = old->cap_ambient; 946 new->cap_bset = old->cap_bset; 947 948 new->jit_keyring = old->jit_keyring; 949 new->thread_keyring = key_get(old->thread_keyring); 950 new->process_keyring = key_get(old->process_keyring); 951 952 security_transfer_creds(new, old); 953 954 commit_creds(new); 955 } 956 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org [-- Attachment #2: config.gz --] [-- Type: application/gzip, Size: 69495 bytes --] ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring 2021-10-24 17:36 ` kernel test robot @ 2021-10-25 14:13 ` Eric W. Biederman 0 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-25 14:13 UTC (permalink / raw) To: kbuild-all [-- Attachment #1: Type: text/plain, Size: 6025 bytes --] kernel test robot <lkp@intel.com> writes: > Hi "Eric, > > Thank you for the patch! Yet something to improve: Fixed already. Thank you for noticing as well. Eric > [auto build test ERROR on linux/master] > [also build test ERROR on v5.15-rc6] > [cannot apply to linus/master jmorris-security/next-testing next-20211022] > [If your patch is applied to the wrong git tree, kindly drop us a note. > And when submitting patch, we suggest to use '--base' as documented in > https://git-scm.com/docs/git-format-patch] > > url: https://github.com/0day-ci/linux/commits/Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 > base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ec681c53f8d2d0ee362ff67f5b98dd8263c15002 > config: arc-allyesconfig (attached as .config) > compiler: arceb-elf-gcc (GCC) 11.2.0 > reproduce (this is a W=1 build): > wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross > chmod +x ~/bin/make.cross > # https://github.com/0day-ci/linux/commit/78e52b4abddecd7a6666f768874ee737c292830d > git remote add linux-review https://github.com/0day-ci/linux > git fetch --no-tags linux-review Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 > git checkout 78e52b4abddecd7a6666f768874ee737c292830d > # save the attached .config to linux build tree > COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=arc > > If you fix the issue, kindly add following tag as appropriate > Reported-by: kernel test robot <lkp@intel.com> > > All errors (new ones prefixed by >>): > > In file included from arch/arc/include/asm/bug.h:30, > from include/linux/bug.h:5, > from include/linux/thread_info.h:13, > from include/asm-generic/preempt.h:5, > from ./arch/arc/include/generated/asm/preempt.h:1, > from include/linux/preempt.h:78, > from include/linux/rcupdate.h:27, > from include/linux/rculist.h:11, > from include/linux/pid.h:5, > from include/linux/sched.h:14, > from security/keys/process_keys.c:9: > security/keys/process_keys.c: In function 'key_change_session_keyring': >>> security/keys/process_keys.c:923:30: error: format '%s' expects a matching 'char *' argument [-Werror=format=] > 923 | WARN_ONCE(1, "In %s get_ucounts failed\n"); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ > include/asm-generic/bug.h:91:62: note: in definition of macro '__WARN_printf' > 91 | warn_slowpath_fmt(__FILE__, __LINE__, taint, arg); \ > | ^~~ > include/linux/once_lite.h:19:25: note: in expansion of macro 'WARN' > 19 | func(__VA_ARGS__); \ > | ^~~~ > include/asm-generic/bug.h:150:9: note: in expansion of macro 'DO_ONCE_LITE_IF' > 150 | DO_ONCE_LITE_IF(condition, WARN, 1, format) > | ^~~~~~~~~~~~~~~ > security/keys/process_keys.c:923:17: note: in expansion of macro 'WARN_ONCE' > 923 | WARN_ONCE(1, "In %s get_ucounts failed\n"); > | ^~~~~~~~~ > security/keys/process_keys.c:923:35: note: format string is defined here > 923 | WARN_ONCE(1, "In %s get_ucounts failed\n"); > | ~^ > | | > | char * > cc1: all warnings being treated as errors > > > vim +923 security/keys/process_keys.c > > 906 > 907 /* > 908 * Replace a process's session keyring on behalf of one of its children when > 909 * the target process is about to resume userspace execution. > 910 */ > 911 void key_change_session_keyring(struct callback_head *twork) > 912 { > 913 const struct cred *old = current_cred(); > 914 struct cred *new = container_of(twork, struct cred, rcu); > 915 > 916 if (unlikely(current->flags & PF_EXITING)) { > 917 put_cred(new); > 918 return; > 919 } > 920 > 921 /* If get_ucounts fails more bits are needed in the refcount */ > 922 if (unlikely(!get_ucounts(old->ucounts))) { > > 923 WARN_ONCE(1, "In %s get_ucounts failed\n"); > 924 put_cred(new); > 925 return; > 926 } > 927 > 928 new-> uid = old-> uid; > 929 new-> euid = old-> euid; > 930 new-> suid = old-> suid; > 931 new->fsuid = old->fsuid; > 932 new-> gid = old-> gid; > 933 new-> egid = old-> egid; > 934 new-> sgid = old-> sgid; > 935 new->fsgid = old->fsgid; > 936 new->user = get_uid(old->user); > 937 new->ucounts = old->ucounts; > 938 new->user_ns = get_user_ns(old->user_ns); > 939 new->group_info = get_group_info(old->group_info); > 940 > 941 new->securebits = old->securebits; > 942 new->cap_inheritable = old->cap_inheritable; > 943 new->cap_permitted = old->cap_permitted; > 944 new->cap_effective = old->cap_effective; > 945 new->cap_ambient = old->cap_ambient; > 946 new->cap_bset = old->cap_bset; > 947 > 948 new->jit_keyring = old->jit_keyring; > 949 new->thread_keyring = key_get(old->thread_keyring); > 950 new->process_keyring = key_get(old->process_keyring); > 951 > 952 security_transfer_creds(new, old); > 953 > 954 commit_creds(new); > 955 } > 956 > > --- > 0-DAY CI Kernel Test Service, Intel Corporation > https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring 2021-10-18 17:24 ` [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring Eric W. Biederman @ 2021-11-06 5:05 ` kernel test robot 2021-11-06 5:05 ` kernel test robot 2021-11-06 20:22 ` kernel test robot 2 siblings, 0 replies; 70+ messages in thread From: kernel test robot @ 2021-11-06 5:05 UTC (permalink / raw) To: Eric W. Biederman; +Cc: llvm, kbuild-all [-- Attachment #1: Type: text/plain, Size: 4576 bytes --] Hi "Eric, Thank you for the patch! Yet something to improve: [auto build test ERROR on linux/master] [cannot apply to linus/master jmorris-security/next-testing v5.15 next-20211106] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ec681c53f8d2d0ee362ff67f5b98dd8263c15002 config: i386-buildonly-randconfig-r003-20211021 (attached as .config) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 3cea2505fd8d99a9ba0cb625aecfe28a47c4e3f8) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/0day-ci/linux/commit/78e52b4abddecd7a6666f768874ee737c292830d git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 git checkout 78e52b4abddecd7a6666f768874ee737c292830d # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=i386 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@intel.com> All errors (new ones prefixed by >>): >> security/keys/process_keys.c:923:21: error: more '%' conversions than data arguments [-Werror,-Wformat-insufficient-args] WARN_ONCE(1, "In %s get_ucounts failed\n"); ~^ include/asm-generic/bug.h:150:38: note: expanded from macro 'WARN_ONCE' DO_ONCE_LITE_IF(condition, WARN, 1, format) ^~~~~~ include/linux/once_lite.h:19:9: note: expanded from macro 'DO_ONCE_LITE_IF' func(__VA_ARGS__); \ ^~~~~~~~~~~ include/asm-generic/bug.h:132:29: note: expanded from macro 'WARN' __WARN_printf(TAINT_WARN, format); \ ^~~~~~ include/asm-generic/bug.h:99:17: note: expanded from macro '__WARN_printf' __warn_printk(arg); \ ^~~ 1 error generated. vim +923 security/keys/process_keys.c 906 907 /* 908 * Replace a process's session keyring on behalf of one of its children when 909 * the target process is about to resume userspace execution. 910 */ 911 void key_change_session_keyring(struct callback_head *twork) 912 { 913 const struct cred *old = current_cred(); 914 struct cred *new = container_of(twork, struct cred, rcu); 915 916 if (unlikely(current->flags & PF_EXITING)) { 917 put_cred(new); 918 return; 919 } 920 921 /* If get_ucounts fails more bits are needed in the refcount */ 922 if (unlikely(!get_ucounts(old->ucounts))) { > 923 WARN_ONCE(1, "In %s get_ucounts failed\n"); 924 put_cred(new); 925 return; 926 } 927 928 new-> uid = old-> uid; 929 new-> euid = old-> euid; 930 new-> suid = old-> suid; 931 new->fsuid = old->fsuid; 932 new-> gid = old-> gid; 933 new-> egid = old-> egid; 934 new-> sgid = old-> sgid; 935 new->fsgid = old->fsgid; 936 new->user = get_uid(old->user); 937 new->ucounts = old->ucounts; 938 new->user_ns = get_user_ns(old->user_ns); 939 new->group_info = get_group_info(old->group_info); 940 941 new->securebits = old->securebits; 942 new->cap_inheritable = old->cap_inheritable; 943 new->cap_permitted = old->cap_permitted; 944 new->cap_effective = old->cap_effective; 945 new->cap_ambient = old->cap_ambient; 946 new->cap_bset = old->cap_bset; 947 948 new->jit_keyring = old->jit_keyring; 949 new->thread_keyring = key_get(old->thread_keyring); 950 new->process_keyring = key_get(old->process_keyring); 951 952 security_transfer_creds(new, old); 953 954 commit_creds(new); 955 } 956 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org [-- Attachment #2: .config.gz --] [-- Type: application/gzip, Size: 36838 bytes --] ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring @ 2021-11-06 5:05 ` kernel test robot 0 siblings, 0 replies; 70+ messages in thread From: kernel test robot @ 2021-11-06 5:05 UTC (permalink / raw) To: kbuild-all [-- Attachment #1: Type: text/plain, Size: 4682 bytes --] Hi "Eric, Thank you for the patch! Yet something to improve: [auto build test ERROR on linux/master] [cannot apply to linus/master jmorris-security/next-testing v5.15 next-20211106] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ec681c53f8d2d0ee362ff67f5b98dd8263c15002 config: i386-buildonly-randconfig-r003-20211021 (attached as .config) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 3cea2505fd8d99a9ba0cb625aecfe28a47c4e3f8) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/0day-ci/linux/commit/78e52b4abddecd7a6666f768874ee737c292830d git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 git checkout 78e52b4abddecd7a6666f768874ee737c292830d # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=i386 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@intel.com> All errors (new ones prefixed by >>): >> security/keys/process_keys.c:923:21: error: more '%' conversions than data arguments [-Werror,-Wformat-insufficient-args] WARN_ONCE(1, "In %s get_ucounts failed\n"); ~^ include/asm-generic/bug.h:150:38: note: expanded from macro 'WARN_ONCE' DO_ONCE_LITE_IF(condition, WARN, 1, format) ^~~~~~ include/linux/once_lite.h:19:9: note: expanded from macro 'DO_ONCE_LITE_IF' func(__VA_ARGS__); \ ^~~~~~~~~~~ include/asm-generic/bug.h:132:29: note: expanded from macro 'WARN' __WARN_printf(TAINT_WARN, format); \ ^~~~~~ include/asm-generic/bug.h:99:17: note: expanded from macro '__WARN_printf' __warn_printk(arg); \ ^~~ 1 error generated. vim +923 security/keys/process_keys.c 906 907 /* 908 * Replace a process's session keyring on behalf of one of its children when 909 * the target process is about to resume userspace execution. 910 */ 911 void key_change_session_keyring(struct callback_head *twork) 912 { 913 const struct cred *old = current_cred(); 914 struct cred *new = container_of(twork, struct cred, rcu); 915 916 if (unlikely(current->flags & PF_EXITING)) { 917 put_cred(new); 918 return; 919 } 920 921 /* If get_ucounts fails more bits are needed in the refcount */ 922 if (unlikely(!get_ucounts(old->ucounts))) { > 923 WARN_ONCE(1, "In %s get_ucounts failed\n"); 924 put_cred(new); 925 return; 926 } 927 928 new-> uid = old-> uid; 929 new-> euid = old-> euid; 930 new-> suid = old-> suid; 931 new->fsuid = old->fsuid; 932 new-> gid = old-> gid; 933 new-> egid = old-> egid; 934 new-> sgid = old-> sgid; 935 new->fsgid = old->fsgid; 936 new->user = get_uid(old->user); 937 new->ucounts = old->ucounts; 938 new->user_ns = get_user_ns(old->user_ns); 939 new->group_info = get_group_info(old->group_info); 940 941 new->securebits = old->securebits; 942 new->cap_inheritable = old->cap_inheritable; 943 new->cap_permitted = old->cap_permitted; 944 new->cap_effective = old->cap_effective; 945 new->cap_ambient = old->cap_ambient; 946 new->cap_bset = old->cap_bset; 947 948 new->jit_keyring = old->jit_keyring; 949 new->thread_keyring = key_get(old->thread_keyring); 950 new->process_keyring = key_get(old->process_keyring); 951 952 security_transfer_creds(new, old); 953 954 commit_creds(new); 955 } 956 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org [-- Attachment #2: config.gz --] [-- Type: application/gzip, Size: 36838 bytes --] ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring 2021-10-18 17:24 ` [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring Eric W. Biederman @ 2021-11-06 20:22 ` kernel test robot 2021-11-06 5:05 ` kernel test robot 2021-11-06 20:22 ` kernel test robot 2 siblings, 0 replies; 70+ messages in thread From: kernel test robot @ 2021-11-06 20:22 UTC (permalink / raw) To: Eric W. Biederman; +Cc: llvm, kbuild-all [-- Attachment #1: Type: text/plain, Size: 4570 bytes --] Hi "Eric, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on linux/master] [cannot apply to linus/master jmorris-security/next-testing v5.15 next-20211106] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ec681c53f8d2d0ee362ff67f5b98dd8263c15002 config: i386-randconfig-a001-20211019 (attached as .config) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project d245f2e8597bfb52c34810a328d42b990e4af1a4) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/0day-ci/linux/commit/78e52b4abddecd7a6666f768874ee737c292830d git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 git checkout 78e52b4abddecd7a6666f768874ee737c292830d # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=i386 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@intel.com> All warnings (new ones prefixed by >>): >> security/keys/process_keys.c:923:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] WARN_ONCE(1, "In %s get_ucounts failed\n"); ~^ include/asm-generic/bug.h:150:38: note: expanded from macro 'WARN_ONCE' DO_ONCE_LITE_IF(condition, WARN, 1, format) ^~~~~~ include/linux/once_lite.h:19:9: note: expanded from macro 'DO_ONCE_LITE_IF' func(__VA_ARGS__); \ ^~~~~~~~~~~ include/asm-generic/bug.h:132:29: note: expanded from macro 'WARN' __WARN_printf(TAINT_WARN, format); \ ^~~~~~ include/asm-generic/bug.h:99:17: note: expanded from macro '__WARN_printf' __warn_printk(arg); \ ^~~ 1 warning generated. vim +923 security/keys/process_keys.c 906 907 /* 908 * Replace a process's session keyring on behalf of one of its children when 909 * the target process is about to resume userspace execution. 910 */ 911 void key_change_session_keyring(struct callback_head *twork) 912 { 913 const struct cred *old = current_cred(); 914 struct cred *new = container_of(twork, struct cred, rcu); 915 916 if (unlikely(current->flags & PF_EXITING)) { 917 put_cred(new); 918 return; 919 } 920 921 /* If get_ucounts fails more bits are needed in the refcount */ 922 if (unlikely(!get_ucounts(old->ucounts))) { > 923 WARN_ONCE(1, "In %s get_ucounts failed\n"); 924 put_cred(new); 925 return; 926 } 927 928 new-> uid = old-> uid; 929 new-> euid = old-> euid; 930 new-> suid = old-> suid; 931 new->fsuid = old->fsuid; 932 new-> gid = old-> gid; 933 new-> egid = old-> egid; 934 new-> sgid = old-> sgid; 935 new->fsgid = old->fsgid; 936 new->user = get_uid(old->user); 937 new->ucounts = old->ucounts; 938 new->user_ns = get_user_ns(old->user_ns); 939 new->group_info = get_group_info(old->group_info); 940 941 new->securebits = old->securebits; 942 new->cap_inheritable = old->cap_inheritable; 943 new->cap_permitted = old->cap_permitted; 944 new->cap_effective = old->cap_effective; 945 new->cap_ambient = old->cap_ambient; 946 new->cap_bset = old->cap_bset; 947 948 new->jit_keyring = old->jit_keyring; 949 new->thread_keyring = key_get(old->thread_keyring); 950 new->process_keyring = key_get(old->process_keyring); 951 952 security_transfer_creds(new, old); 953 954 commit_creds(new); 955 } 956 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org [-- Attachment #2: .config.gz --] [-- Type: application/gzip, Size: 37272 bytes --] ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring @ 2021-11-06 20:22 ` kernel test robot 0 siblings, 0 replies; 70+ messages in thread From: kernel test robot @ 2021-11-06 20:22 UTC (permalink / raw) To: kbuild-all [-- Attachment #1: Type: text/plain, Size: 4676 bytes --] Hi "Eric, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on linux/master] [cannot apply to linus/master jmorris-security/next-testing v5.15 next-20211106] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ec681c53f8d2d0ee362ff67f5b98dd8263c15002 config: i386-randconfig-a001-20211019 (attached as .config) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project d245f2e8597bfb52c34810a328d42b990e4af1a4) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/0day-ci/linux/commit/78e52b4abddecd7a6666f768874ee737c292830d git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review Eric-W-Biederman/ucounts-Pair-inc_rlimit_ucounts-with-dec_rlimit_ucoutns-in-commit_creds/20211019-022345 git checkout 78e52b4abddecd7a6666f768874ee737c292830d # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=i386 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@intel.com> All warnings (new ones prefixed by >>): >> security/keys/process_keys.c:923:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] WARN_ONCE(1, "In %s get_ucounts failed\n"); ~^ include/asm-generic/bug.h:150:38: note: expanded from macro 'WARN_ONCE' DO_ONCE_LITE_IF(condition, WARN, 1, format) ^~~~~~ include/linux/once_lite.h:19:9: note: expanded from macro 'DO_ONCE_LITE_IF' func(__VA_ARGS__); \ ^~~~~~~~~~~ include/asm-generic/bug.h:132:29: note: expanded from macro 'WARN' __WARN_printf(TAINT_WARN, format); \ ^~~~~~ include/asm-generic/bug.h:99:17: note: expanded from macro '__WARN_printf' __warn_printk(arg); \ ^~~ 1 warning generated. vim +923 security/keys/process_keys.c 906 907 /* 908 * Replace a process's session keyring on behalf of one of its children when 909 * the target process is about to resume userspace execution. 910 */ 911 void key_change_session_keyring(struct callback_head *twork) 912 { 913 const struct cred *old = current_cred(); 914 struct cred *new = container_of(twork, struct cred, rcu); 915 916 if (unlikely(current->flags & PF_EXITING)) { 917 put_cred(new); 918 return; 919 } 920 921 /* If get_ucounts fails more bits are needed in the refcount */ 922 if (unlikely(!get_ucounts(old->ucounts))) { > 923 WARN_ONCE(1, "In %s get_ucounts failed\n"); 924 put_cred(new); 925 return; 926 } 927 928 new-> uid = old-> uid; 929 new-> euid = old-> euid; 930 new-> suid = old-> suid; 931 new->fsuid = old->fsuid; 932 new-> gid = old-> gid; 933 new-> egid = old-> egid; 934 new-> sgid = old-> sgid; 935 new->fsgid = old->fsgid; 936 new->user = get_uid(old->user); 937 new->ucounts = old->ucounts; 938 new->user_ns = get_user_ns(old->user_ns); 939 new->group_info = get_group_info(old->group_info); 940 941 new->securebits = old->securebits; 942 new->cap_inheritable = old->cap_inheritable; 943 new->cap_permitted = old->cap_permitted; 944 new->cap_effective = old->cap_effective; 945 new->cap_ambient = old->cap_ambient; 946 new->cap_bset = old->cap_bset; 947 948 new->jit_keyring = old->jit_keyring; 949 new->thread_keyring = key_get(old->thread_keyring); 950 new->process_keyring = key_get(old->process_keyring); 951 952 security_transfer_creds(new, old); 953 954 commit_creds(new); 955 } 956 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org [-- Attachment #2: config.gz --] [-- Type: application/gzip, Size: 37272 bytes --] ^ permalink raw reply [flat|nested] 70+ messages in thread
* [PATCH 0/4] ucounts: misc cleanups 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman ` (2 preceding siblings ...) 2021-10-18 17:24 ` [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring Eric W. Biederman @ 2021-10-18 17:54 ` Eric W. Biederman 2021-10-18 17:55 ` [PATCH 1/4] ucounts: In set_cred_ucounts assume new->ucounts is non-NULL Eric W. Biederman ` (4 more replies) 2021-10-18 22:28 ` [PATCH 0/3] ucounts: misc fixes Yu Zhao 4 siblings, 5 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:54 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton The following changes are a set of miscellaneous fixes that makes the ucount code a little bit easier to read. There are all things that I ran into while helping hunt the crazy reference count bug. I am aiming these at the next merge window and 5.16 rather than bug fixes to get into the current 5.15. Eric W. Biederman (4): ucounts: In set_cred_ucounts assume new->ucounts is non-NULL ucounts: Remove unnecessary test for NULL ucount in get_ucounts ucounts: Add get_ucounts_or_wrap for clarity ucounts: Use atomic_long_sub_return for clarity kernel/cred.c | 5 ++--- kernel/ucount.c | 20 +++++++++++++------- 2 files changed, 15 insertions(+), 10 deletions(-) Eric ^ permalink raw reply [flat|nested] 70+ messages in thread
* [PATCH 1/4] ucounts: In set_cred_ucounts assume new->ucounts is non-NULL 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman @ 2021-10-18 17:55 ` Eric W. Biederman 2021-10-18 17:56 ` [PATCH 2/4] ucounts: Remove unnecessary test for NULL ucount in get_ucounts Eric W. Biederman ` (3 subsequent siblings) 4 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:55 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton Any cred that is destined for use by commit_creds must have a non-NULL cred->ucounts field. Only curing credential construction is a NULL cred->ucounts valid. Only abort_creds, put_cred, and put_cred_rcu needs to deal with a cred with a NULL ucount. As set_cred_ucounts is non of those case don't confuse people by handling something that can not happen. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/cred.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/kernel/cred.c b/kernel/cred.c index 1ae0b4948a5a..473d17c431f3 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -676,15 +676,14 @@ int set_cred_ucounts(struct cred *new) * This optimization is needed because alloc_ucounts() uses locks * for table lookups. */ - if (old_ucounts && old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid)) + if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid)) return 0; if (!(new_ucounts = alloc_ucounts(new->user_ns, new->euid))) return -EAGAIN; new->ucounts = new_ucounts; - if (old_ucounts) - put_ucounts(old_ucounts); + put_ucounts(old_ucounts); return 0; } -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* [PATCH 2/4] ucounts: Remove unnecessary test for NULL ucount in get_ucounts 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman 2021-10-18 17:55 ` [PATCH 1/4] ucounts: In set_cred_ucounts assume new->ucounts is non-NULL Eric W. Biederman @ 2021-10-18 17:56 ` Eric W. Biederman 2021-10-18 17:56 ` [PATCH 3/4] ucounts: Add get_ucounts_or_wrap for clarity Eric W. Biederman ` (2 subsequent siblings) 4 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:56 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton All of the callers of get_ucounts are passeds a non-NULL value so stop handling a NULL ucounts pointer in get_ucounts. It is guaranteed that ever valid fully formed cred that is passed to commit_cred contains a non-NULL ucounts pointer. This in turn gurantees that current_ucounts() never returns NULL. The call of get_ucounts in user_shm_lock is always passed current_ucounts(). The call of get_ucounts in mqueue_get_inode is always passed current_ucounts(). The call of get_ucounts in inc_rlmit_get_ucounts is always passed iter, after iter has been verified to be non-NULL. The call of get_ucounts in key_change_session_keyring is always passed current_ucounts(). The call of get_ucounts in prepare_cred is always passed current_ucounts(). The call of get_ucounts in prepare_kernel_cred is always passed task->cred->ucounts or init_cred->ucounts which being on tasks are guaranteed to have a non-NULL ucounts field. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/ucount.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/ucount.c b/kernel/ucount.c index eb03f3c68375..708d05164a7d 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -152,7 +152,7 @@ static void hlist_add_ucounts(struct ucounts *ucounts) struct ucounts *get_ucounts(struct ucounts *ucounts) { - if (ucounts && atomic_add_negative(1, &ucounts->count)) { + if (atomic_add_negative(1, &ucounts->count)) { put_ucounts(ucounts); ucounts = NULL; } -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* [PATCH 3/4] ucounts: Add get_ucounts_or_wrap for clarity 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman 2021-10-18 17:55 ` [PATCH 1/4] ucounts: In set_cred_ucounts assume new->ucounts is non-NULL Eric W. Biederman 2021-10-18 17:56 ` [PATCH 2/4] ucounts: Remove unnecessary test for NULL ucount in get_ucounts Eric W. Biederman @ 2021-10-18 17:56 ` Eric W. Biederman 2021-10-18 17:57 ` [PATCH 4/4] ucounts: Use atomic_long_sub_return " Eric W. Biederman 2021-10-18 22:29 ` [PATCH 0/4] ucounts: misc cleanups Yu Zhao 4 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:56 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton Add a helper function get_ucounts_or_wrap that is a trivial wrapper around atomic_add_negative, that makes it clear how atomic_add_negative is used in the context of ucounts. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/ucount.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/kernel/ucount.c b/kernel/ucount.c index 708d05164a7d..133b6044fda4 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -150,9 +150,15 @@ static void hlist_add_ucounts(struct ucounts *ucounts) spin_unlock_irq(&ucounts_lock); } +static inline bool get_ucounts_or_wrap(struct ucounts *ucounts) +{ + /* Returns true on a successful get, false if the count wraps. */ + return !atomic_add_negative(1, &ucounts->count); +} + struct ucounts *get_ucounts(struct ucounts *ucounts) { - if (atomic_add_negative(1, &ucounts->count)) { + if (!get_ucounts_or_wrap(ucounts)) { put_ucounts(ucounts); ucounts = NULL; } @@ -163,7 +169,7 @@ struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid) { struct hlist_head *hashent = ucounts_hashentry(ns, uid); struct ucounts *ucounts, *new; - long overflow; + bool wrapped; spin_lock_irq(&ucounts_lock); ucounts = find_ucounts(ns, uid, hashent); @@ -188,9 +194,9 @@ struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid) return new; } } - overflow = atomic_add_negative(1, &ucounts->count); + wrapped = !get_ucounts_or_wrap(ucounts); spin_unlock_irq(&ucounts_lock); - if (overflow) { + if (wrapped) { put_ucounts(ucounts); return NULL; } -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* [PATCH 4/4] ucounts: Use atomic_long_sub_return for clarity 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman ` (2 preceding siblings ...) 2021-10-18 17:56 ` [PATCH 3/4] ucounts: Add get_ucounts_or_wrap for clarity Eric W. Biederman @ 2021-10-18 17:57 ` Eric W. Biederman 2021-10-18 22:29 ` [PATCH 0/4] ucounts: misc cleanups Yu Zhao 4 siblings, 0 replies; 70+ messages in thread From: Eric W. Biederman @ 2021-10-18 17:57 UTC (permalink / raw) To: Alexey Gladkov Cc: Rune Kleveland, Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Hillf Danton Decrement ucounts using atomic_long_sub_return to make it clear the point is for the ucount to decrease. Not a big deal but it should make it easier to catch bugs. Suggested-by: Yu Zhao <yuzhao@google.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/ucount.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/ucount.c b/kernel/ucount.c index 133b6044fda4..4f5613dac227 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -282,7 +282,7 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) struct ucounts *iter; long new = -1; /* Silence compiler warning */ for (iter = ucounts; iter; iter = iter->ns->ucounts) { - long dec = atomic_long_add_return(-v, &iter->ucount[type]); + long dec = atomic_long_sub_return(v, &iter->ucount[type]); WARN_ON_ONCE(dec < 0); if (iter == ucounts) new = dec; @@ -295,7 +295,7 @@ static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, { struct ucounts *iter, *next; for (iter = ucounts; iter != last; iter = next) { - long dec = atomic_long_add_return(-1, &iter->ucount[type]); + long dec = atomic_long_sub_return(1, &iter->ucount[type]); WARN_ON_ONCE(dec < 0); next = iter->ns->ucounts; if (dec == 0) @@ -332,7 +332,7 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) } return ret; dec_unwind: - dec = atomic_long_add_return(-1, &iter->ucount[type]); + dec = atomic_long_sub_return(1, &iter->ucount[type]); WARN_ON_ONCE(dec < 0); unwind: do_dec_rlimit_put_ucounts(ucounts, iter, type); -- 2.20.1 ^ permalink raw reply related [flat|nested] 70+ messages in thread
* Re: [PATCH 0/4] ucounts: misc cleanups 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman ` (3 preceding siblings ...) 2021-10-18 17:57 ` [PATCH 4/4] ucounts: Use atomic_long_sub_return " Eric W. Biederman @ 2021-10-18 22:29 ` Yu Zhao 4 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-10-18 22:29 UTC (permalink / raw) To: Eric W. Biederman Cc: Alexey Gladkov, Rune Kleveland, Jordan Glover, LKML, Linux-MM, containers\@lists.linux-foundation.org, Hillf Danton On Mon, Oct 18, 2021 at 11:55 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > > The following changes are a set of miscellaneous fixes that makes > the ucount code a little bit easier to read. There are all things > that I ran into while helping hunt the crazy reference count > bug. > > I am aiming these at the next merge window and 5.16 rather than bug > fixes to get into the current 5.15. > > Eric W. Biederman (4): > ucounts: In set_cred_ucounts assume new->ucounts is non-NULL > ucounts: Remove unnecessary test for NULL ucount in get_ucounts > ucounts: Add get_ucounts_or_wrap for clarity > ucounts: Use atomic_long_sub_return for clarity > > kernel/cred.c | 5 ++--- > kernel/ucount.c | 20 +++++++++++++------- > 2 files changed, 15 insertions(+), 10 deletions(-) Thanks for the cleanups. Tested the whole series on the latest 5.15-rc6. Tested-by: Yu Zhao <yuzhao@google.com> ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH 0/3] ucounts: misc fixes 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman ` (3 preceding siblings ...) 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman @ 2021-10-18 22:28 ` Yu Zhao 4 siblings, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-10-18 22:28 UTC (permalink / raw) To: Eric W. Biederman Cc: Alexey Gladkov, Rune Kleveland, Jordan Glover, LKML, Linux-MM, containers\@lists.linux-foundation.org, Hillf Danton, David Howells, Jarkko Sakkinen On Mon, Oct 18, 2021 at 11:21 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > > While digging into the previous ucount kernel crashes I found some minor > bugs in the ucount code. When hit these bugs all result in a ucount > either being counted in the wrong location or leak of a struct ucounts. > > Nothing particularly serious but certainly things that should be fixed. > > Eric W. Biederman (3): > ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds > ucounts: Proper error handling in set_cred_ucounts > ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring > > kernel/cred.c | 9 ++++----- > security/keys/process_keys.c | 8 ++++++++ > 2 files changed, 12 insertions(+), 5 deletions(-) Thanks for the fixes. Tested the whole series on the latest 5.15-rc6. Tested-by: Yu Zhao <yuzhao@google.com> ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH v2] ucounts: Fix signal ucount refcounting 2021-10-18 16:06 ` [PATCH v2] " Eric W. Biederman 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman @ 2021-10-18 22:26 ` Yu Zhao 1 sibling, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-10-18 22:26 UTC (permalink / raw) To: Eric W. Biederman Cc: Rune Kleveland, Alexey Gladkov, Jordan Glover, LKML, Linux-MM, containers\@lists.linux-foundation.org, Hillf Danton On Mon, Oct 18, 2021 at 10:06 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > > In commit fda31c50292a ("signal: avoid double atomic counter > increments for user accounting") Linus made a clever optimization to > how rlimits and the struct user_struct. Unfortunately that > optimization does not work in the obvious way when moved to nested > rlimits. The problem is that the last decrement of the per user > namespace per user sigpending counter might also be the last decrement > of the sigpending counter in the parent user namespace as well. Which > means that simply freeing the leaf ucount in __free_sigqueue is not > enough. > > Maintain the optimization and handle the tricky cases by introducing > inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. > > By moving the entire optimization into functions that perform all of > the work it becomes possible to ensure that every level is handled > properly. > > The new function inc_rlimit_get_ucounts returns 0 on failure to > increment the ucount. This is different than inc_rlimit_ucounts which > increments the ucounts and returns LONG_MAX if the ucount counter has > exceeded it's maximum or it wrapped (to indicate the counter needs to > decremented). > > I wish we had a single user to account all pending signals to across > all of the threads of a process so this complexity was not necessary > > Cc: stable@vger.kernel.org > Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") > v1: https://lkml.kernel.org/r/87mtnavszx.fsf_-_@disp2133 > Tested-by: Rune Kleveland <rune.kleveland@infomedia.dk> > Tested-by: Yu Zhao <yuzhao@google.com> > Tested-by: Jordan Glover <Golden_Miller83@protonmail.ch> > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> > --- > > This is my version of the fix with all of the feedback rolled in. > I have tested it and believe this is ready to send out. > > If folks code take a once over and see if I have spotted things. > > For the people who are testing or have tested this I have added your > tested-by's please let me know if you mind. > > Eric Retested on the latest 5.15-rc6. This patch fixes the following crash: [ 3307.621443] ================================================================== [ 3307.628890] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 3307.634903] Write of size 8 at addr ffffff80a5e4c520 by task kworker/7:3/201 [ 3307.642149] [ 3307.643695] CPU: 7 PID: 201 Comm: kworker/7:3 Not tainted 5.15.0-rc6-lockdep+ #7 [ 3307.651291] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 3307.658001] Workqueue: events free_user_ns [ 3307.662231] Call trace: [ 3307.664750] dump_backtrace+0x0/0x42c [ 3307.668522] show_stack+0x24/0x30 [ 3307.671935] dump_stack_lvl+0xd0/0x100 [ 3307.675797] print_address_description+0x30/0x304 [ 3307.680646] kasan_report+0x190/0x1d8 [ 3307.684419] kasan_check_range+0x1ac/0x1bc [ 3307.688630] __kasan_check_write+0x44/0x54 [ 3307.692852] dec_ucount+0x50/0xd8 [ 3307.696266] free_user_ns+0x1b0/0x288 [ 3307.700036] process_one_work+0x7b4/0x1130 [ 3307.704251] worker_thread+0x800/0xcf4 [ 3307.708111] kthread+0x2a8/0x358 [ 3307.711437] ret_from_fork+0x10/0x20 [ 3307.715121] [ 3307.716664] Allocated by task 6564: [ 3307.720253] kasan_save_stack+0x38/0x68 [ 3307.724206] __kasan_kmalloc+0x9c/0xb8 [ 3307.728068] kmem_cache_alloc_trace+0x260/0x32c [ 3307.732729] alloc_ucounts+0x150/0x374 [ 3307.736589] set_cred_ucounts+0x178/0x240 [ 3307.740714] __sys_setresuid+0x31c/0x4f8 [ 3307.744754] __arm64_sys_setresuid+0x84/0x98 [ 3307.749153] invoke_syscall+0xcc/0x2bc [ 3307.753012] el0_svc_common+0x118/0x1ec [ 3307.756961] do_el0_svc_compat+0x50/0x60 [ 3307.761005] el0_svc_compat+0x5c/0xec [ 3307.764774] el0t_32_sync_handler+0xc0/0xf0 [ 3307.769083] el0t_32_sync+0x1a4/0x1a8 [ 3307.772852] [ 3307.774399] The buggy address belongs to the object at ffffff80a5e4c500 [ 3307.774399] which belongs to the cache kmalloc-256 of size 256 [ 3307.787250] The buggy address is located 32 bytes inside of [ 3307.787250] 256-byte region [ffffff80a5e4c500, ffffff80a5e4c600) [ 3307.799216] The buggy address belongs to the page: [ 3307.804141] page:fffffffe02979200 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffff80a5e4c100 pfn:0x125e48 [ 3307.815127] head:fffffffe02979200 order:3 compound_mapcount:0 compound_pincount:0 [ 3307.822808] flags: 0x8000000000010200(slab|head|zone=2) [ 3307.828187] raw: 8000000000010200 fffffffe0250ba08 fffffffe00f04a08 ffffff808000c980 [ 3307.836148] raw: ffffff80a5e4c100 0000000000200001 00000001ffffffff 0000000000000000 [ 3307.844104] page dumped because: kasan: bad access detected [ 3307.849837] [ 3307.851381] Memory state around the buggy address: [ 3307.856307] ffffff80a5e4c400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3307.863729] ffffff80a5e4c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3307.871146] >ffffff80a5e4c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3307.878562] ^ [ 3307.882956] ffffff80a5e4c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3307.890375] ffffff80a5e4c600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3307.897800] ================================================================== > include/linux/user_namespace.h | 2 ++ > kernel/signal.c | 25 +++++------------ > kernel/ucount.c | 49 ++++++++++++++++++++++++++++++++++ > 3 files changed, 57 insertions(+), 19 deletions(-) > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index eb70cabe6e7f..33a4240e6a6f 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -127,6 +127,8 @@ static inline long get_ucounts_value(struct ucounts *ucounts, enum ucount_type t > > long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v); > +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type); > +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type); > bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max); > > static inline void set_rlimit_ucount_max(struct user_namespace *ns, > diff --git a/kernel/signal.c b/kernel/signal.c > index a3229add4455..13d2505a14a0 100644 > --- a/kernel/signal.c > +++ b/kernel/signal.c > @@ -425,22 +425,10 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > */ > rcu_read_lock(); > ucounts = task_ucounts(t); > - sigpending = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > - switch (sigpending) { > - case 1: > - if (likely(get_ucounts(ucounts))) > - break; > - fallthrough; > - case LONG_MAX: > - /* > - * we need to decrease the ucount in the userns tree on any > - * failure to avoid counts leaking. > - */ > - dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > - rcu_read_unlock(); > - return NULL; > - } > + sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > rcu_read_unlock(); > + if (!sigpending) > + return NULL; > > if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { > q = kmem_cache_alloc(sigqueue_cachep, gfp_flags); > @@ -449,8 +437,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, > } > > if (unlikely(q == NULL)) { > - if (dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) > - put_ucounts(ucounts); > + dec_rlimit_put_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); > } else { > INIT_LIST_HEAD(&q->list); > q->flags = sigqueue_flags; > @@ -463,8 +450,8 @@ static void __sigqueue_free(struct sigqueue *q) > { > if (q->flags & SIGQUEUE_PREALLOC) > return; > - if (q->ucounts && dec_rlimit_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING, 1)) { > - put_ucounts(q->ucounts); > + if (q->ucounts) { > + dec_rlimit_put_ucounts(q->ucounts, UCOUNT_RLIMIT_SIGPENDING); > q->ucounts = NULL; > } > kmem_cache_free(sigqueue_cachep, q); > diff --git a/kernel/ucount.c b/kernel/ucount.c > index bb51849e6375..eb03f3c68375 100644 > --- a/kernel/ucount.c > +++ b/kernel/ucount.c > @@ -284,6 +284,55 @@ bool dec_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v) > return (new == 0); > } > > +static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts, > + struct ucounts *last, enum ucount_type type) > +{ > + struct ucounts *iter, *next; > + for (iter = ucounts; iter != last; iter = next) { > + long dec = atomic_long_add_return(-1, &iter->ucount[type]); > + WARN_ON_ONCE(dec < 0); > + next = iter->ns->ucounts; > + if (dec == 0) > + put_ucounts(iter); > + } > +} > + > +void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum ucount_type type) > +{ > + do_dec_rlimit_put_ucounts(ucounts, NULL, type); > +} > + > +long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) > +{ > + /* Caller must hold a reference to ucounts */ > + struct ucounts *iter; > + long dec, ret = 0; > + > + for (iter = ucounts; iter; iter = iter->ns->ucounts) { > + long max = READ_ONCE(iter->ns->ucount_max[type]); > + long new = atomic_long_add_return(1, &iter->ucount[type]); > + if (new < 0 || new > max) > + goto unwind; > + if (iter == ucounts) > + ret = new; > + /* > + * Grab an extra ucount reference for the caller when > + * the rlimit count was previously 0. > + */ > + if (new != 1) > + continue; > + if (!get_ucounts(iter)) > + goto dec_unwind; > + } > + return ret; > +dec_unwind: > + dec = atomic_long_add_return(-1, &iter->ucount[type]); > + WARN_ON_ONCE(dec < 0); > +unwind: > + do_dec_rlimit_put_ucounts(ucounts, iter, type); > + return 0; > +} > + > bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max) > { > struct ucounts *iter; > -- > 2.20.1 > ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-04 17:19 ` Eric W. Biederman ` (2 preceding siblings ...) 2021-10-10 8:59 ` Rune Kleveland @ 2021-10-11 13:39 ` Alexey Gladkov 3 siblings, 0 replies; 70+ messages in thread From: Alexey Gladkov @ 2021-10-11 13:39 UTC (permalink / raw) To: Eric W. Biederman Cc: Yu Zhao, Jordan Glover, LKML, linux-mm, containers, Rune Kleveland, Hillf Danton On Mon, Oct 04, 2021 at 12:19:16PM -0500, Eric W. Biederman wrote: > ebiederm@xmission.com (Eric W. Biederman) writes: > > > Adding Rune Kleveland to the discussion as he also seems to have > > reproduced the issue. > > > > Alex and I have been starring at the code and the reports and this > > bug is hiding well. Here is what we have figured out so far. > > > > Both the warning from free_user_ns calling dec_ucount that Jordan Glover > > reported and the KASAN error that Yu Zhao has reported appear to have > > the same cause. Using a ucounts structure after it has been freed and > > reallocated as something else. > > > > I have just skimmed through the recent report from Rune Kleveland > > and it appears also to be a use after free. Especially since the > > second failure in the log is slub complaining about trying to free > > the ucounts data structure. > > > > We looked through the users of put_ucounts and we don't see any obvious > > buggy users that would be freeing the data structure early. > > > > Alex has tried to reproduce this so far is not having any luck. > > Folks can you tell what compiler versions you are using and share your > > kernel config with us? That might help. > > > > The little debug diff below is my guess of what is happening. If the > > folks who can reproduce this issue can try the patch below and let me > > know if the warnings fire that would be appreciated. It is still not > > enough to track down the bug but at least it will confirm my current > > hypothesis about how things look before there is a use of memory after > > it is freed. > > Bah. Scratch that test patch. I just double checked myself and > cred->ucounts and cred->user_ns->ucounts should never be equal, > as the user namespace is counted in it's parent user namespace. > > That observation now tells me I have a parent user namespace that went > corrupt. > > Back to the drawing board. > > > > Thank you, > > Eric > > > > diff --git a/kernel/cred.c b/kernel/cred.c > > index f784e08c2fbd..e7ffaa3cf5a6 100644 > > --- a/kernel/cred.c > > +++ b/kernel/cred.c > > @@ -120,6 +120,12 @@ static void put_cred_rcu(struct rcu_head *rcu) > > if (cred->group_info) > > put_group_info(cred->group_info); > > free_uid(cred->user); > > +#if 1 > > + if ((cred->ucounts == cred->user_ns->ucounts) && > > + (atomic_read(&cred->ucounts->count) == 1)) { > > + WARN_ONCE(1, "put_cred_rcu: ucount count 1\n"); > > + } > > +#endif > > if (cred->ucounts) > > put_ucounts(cred->ucounts); > > put_user_ns(cred->user_ns); > > diff --git a/kernel/exit.c b/kernel/exit.c > > index 91a43e57a32e..60fd88b34c1a 100644 > > --- a/kernel/exit.c > > +++ b/kernel/exit.c > > @@ -743,6 +743,13 @@ void __noreturn do_exit(long code) > > if (unlikely(!tsk->pid)) > > panic("Attempted to kill the idle task!"); > > > > +#if 1 > > + if ((tsk->cred->ucounts == tsk->cred->user_ns->ucounts) && > > + (atomic_read(tsk->cred->ucounts->count) == 1)) { > > + WARN_ONCE(1, "do_exit: ucount count 1\n"); > > + } > > +#endif > > + > > /* > > * If do_exit is called because this processes oopsed, it's possible > > * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before > It looks like I found a fairly reliable reproducer. I'm able to reproduce the problem on ARCH=um. I added a bit of debugging and it looks like the namespace has a reference count problem: [ 6.970000] ------------[ cut here ]------------ [ 6.970000] WARNING: CPU: 0 PID: 18 at kernel/ucount.c:257 dec_ucount+0x86/0xfc [ 6.970000] dec_ucounts: accessing freed ucounts: 0000000061202780 ^^^^^^^^^^^^^^^^ This is a pointer to the freed ucounts. [ 6.970000] Modules linked in: [ 6.970000] CPU: 0 PID: 18 Comm: kworker/u2:1 Tainted: G W 5.15.0-rc3-00082-ga81d1c67022e-dirty #14 [ 6.970000] Workqueue: netns cleanup_net [ 6.970000] Stack: [ 6.970000] 800bfca0 602693cb 603d3767 00000000 [ 6.970000] 6048c52d 00000009 603d23b5 60046b28 [ 6.970000] 800bfcc0 603d37a7 603d3767 800bfd20 [ 6.970000] Call Trace: [ 6.970000] [<603d23b5>] ? _printk+0x0/0xa1 [ 6.970000] [<600238df>] show_stack+0x14b/0x15a [ 6.970000] [<602693cb>] ? dump_stack_print_info+0xeb/0xfa [ 6.970000] [<603d3767>] ? dump_stack+0x0/0x45 [ 6.970000] [<603d23b5>] ? _printk+0x0/0xa1 [ 6.970000] [<60046b28>] ? __local_bh_enable_ip+0x0/0xf8 [ 6.970000] [<603d37a7>] dump_stack+0x40/0x45 [ 6.970000] [<603d3767>] ? dump_stack+0x0/0x45 [ 6.970000] [<60043633>] __warn+0x101/0x149 [ 6.970000] [<603d1559>] warn_slowpath_fmt+0xde/0xec [ 6.970000] [<6003953b>] ? set_signals+0x0/0x48 [ 6.970000] [<60265087>] ? free_object+0x1d/0x73 [ 6.970000] [<603d147b>] ? warn_slowpath_fmt+0x0/0xec [ 6.970000] [<60083a2d>] ? destroy_rcu_head+0x27/0x29 [ 6.970000] [<60083ba3>] ? __wait_rcu_gp+0x12d/0x14f [ 6.970000] [<600846bb>] ? rcu_barrier+0x0/0x40 [ 6.970000] [<6006471d>] dec_ucount+0x86/0xfc [ 6.970000] [<60064697>] ? dec_ucount+0x0/0xfc [ 6.970000] [<6031221f>] cleanup_net+0x2cb/0x326 [ 6.970000] [<60039468>] ? unblock_signals+0x0/0xd3 [ 6.970000] [<60059daa>] process_one_work+0x1e1/0x2df [ 6.970000] [<60039445>] ? block_signals+0x0/0x23 [ 6.970000] [<6003947c>] ? unblock_signals+0x14/0xd3 [ 6.970000] [<6005658e>] ? move_linked_works+0x0/0x8a [ 6.970000] [<6005a49c>] worker_thread+0x293/0x3c0 [ 6.970000] [<600566bc>] ? set_pf_worker+0x0/0x6d [ 6.970000] [<6005ecf2>] ? arch_local_irq_save+0x0/0x29 [ 6.970000] [<60045960>] ? do_exit+0x0/0x93e [ 6.970000] [<6005a209>] ? worker_thread+0x0/0x3c0 [ 6.970000] [<60060554>] kthread+0x171/0x179 [ 6.970000] [<6002230e>] new_thread_handler+0x8e/0xbf [ 6.970000] ---[ end trace 02feadf6f35abde2 ]--- [ 6.970000] [ 6.970000] Modules linked in: [ 6.970000] Pid: 18, comm: kworker/u2:1 Tainted: G W 5.15.0-rc3-00082-ga81d1c67022e-dirty [ 6.970000] RIP: 0033:[<000000006006476f>] [ 6.970000] RSP: 00000000800bfe20 EFLAGS: 00010246 [ 6.970000] RAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000000000000 [ 6.970000] RDX: 00000000612027c8 RSI: 00000000ffffffff RDI: 0000000000000009 [ 6.970000] RBP: 00000000800bfe40 R08: 0000000060551bc8 R09: 0000000000015920 [ 6.970000] R10: 00000000600203e0 R11: 0000000000015920 R12: 0000000061202780 [ 6.970000] R13: 000000006057bca6 R14: 0000000061202780 R15: 0000000060046b28 [ 6.970000] Kernel panic - not syncing: Segfault with no mm [ 6.970000] CPU: 0 PID: 18 Comm: kworker/u2:1 Tainted: G W 5.15.0-rc3-00082-ga81d1c67022e-dirty #14 [ 6.970000] Workqueue: netns cleanup_net [ 6.970000] Stack: [ 6.970000] 800bfe48 612d69c0 800bfe70 60064697 [ 6.970000] 800bfeb0 6031221f ffffffff800bfe90 605735c0 [ 6.970000] 60039468 ffff8d00 800bfe70 800bfe70 [ 6.970000] Call Trace: [ 6.970000] [<60064697>] ? dec_ucount+0x0/0xfc [ 6.970000] [<6031221f>] cleanup_net+0x2cb/0x326 [ 6.970000] [<60039468>] ? unblock_signals+0x0/0xd3 [ 6.970000] [<60059daa>] process_one_work+0x1e1/0x2df [ 6.970000] [<60039445>] ? block_signals+0x0/0x23 [ 6.970000] [<6003947c>] ? unblock_signals+0x14/0xd3 [ 6.970000] [<6005658e>] ? move_linked_works+0x0/0x8a [ 6.970000] [<6005a49c>] worker_thread+0x293/0x3c0 [ 6.970000] [<600566bc>] ? set_pf_worker+0x0/0x6d [ 6.970000] [<6005ecf2>] ? arch_local_irq_save+0x0/0x29 [ 6.970000] [<60045960>] ? do_exit+0x0/0x93e [ 6.970000] [<6005a209>] ? worker_thread+0x0/0x3c0 [ 6.970000] [<60060554>] kthread+0x171/0x179 [ 6.970000] [<6002230e>] new_thread_handler+0x8e/0xbf This is where this ucounts was created: [ 5.530000] ------------[ cut here ]------------ [ 5.530000] WARNING: CPU: 0 PID: 216 at kernel/ucount.c:187 alloc_ucounts+0x174/0x189 [ 5.530000] allooc_ucounts: new ucounts ucounts=0000000061202780 [ 5.530000] Modules linked in: [ 5.530000] CPU: 0 PID: 216 Comm: unshare Tainted: G W 5.15.0-rc3-00082-ga81d1c67022e-dirty #14 [ 5.530000] Stack: [ 5.530000] 8045bb00 602693cb 603d3767 00000000 [ 5.530000] 6048c52d 00000009 603d23b5 6063d388 [ 5.530000] 8045bb20 603d37a7 603d3767 8045bb80 [ 5.530000] Call Trace: [ 5.530000] [<603d23b5>] ? _printk+0x0/0xa1 [ 5.530000] [<600238df>] show_stack+0x14b/0x15a [ 5.530000] [<602693cb>] ? dump_stack_print_info+0xeb/0xfa [ 5.530000] [<603d3767>] ? dump_stack+0x0/0x45 [ 5.530000] [<603d23b5>] ? _printk+0x0/0xa1 [ 5.530000] [<603d37a7>] dump_stack+0x40/0x45 [ 5.530000] [<603d3767>] ? dump_stack+0x0/0x45 [ 5.530000] [<60043633>] __warn+0x101/0x149 [ 5.530000] [<60039468>] ? unblock_signals+0x0/0xd3 [ 5.530000] [<603d1559>] warn_slowpath_fmt+0xde/0xec [ 5.530000] [<60274613>] ? memcmp+0x0/0x2f [ 5.530000] [<60039445>] ? block_signals+0x0/0x23 [ 5.530000] [<603d147b>] ? warn_slowpath_fmt+0x0/0xec [ 5.530000] [<600ff06d>] ? arch_local_irq_save+0x0/0x29 [ 5.530000] [<600ff8d7>] ? slab_post_alloc_hook+0x5b/0x1ae [ 5.530000] [<60039445>] ? block_signals+0x0/0x23 [ 5.530000] [<600645e2>] alloc_ucounts+0x174/0x189 [ 5.530000] [<600645f7>] ? inc_ucount+0x0/0xa0 [ 5.530000] [<60064618>] inc_ucount+0x21/0xa0 [ 5.530000] [<6012f6e0>] alloc_mnt_ns+0x53/0x193 [ 5.530000] [<600ff06d>] ? arch_local_irq_save+0x0/0x29 [ 5.530000] [<601334c6>] ? copy_mnt_ns+0x0/0x29e [ 5.530000] [<60133570>] copy_mnt_ns+0xaa/0x29e [ 5.530000] [<600609a6>] create_new_namespaces+0x7c/0x2b4 [ 5.530000] [<60060ed7>] unshare_nsproxy_namespaces+0xb1/0xcb [ 5.530000] [<600b1111>] ? unshare_userns+0x4c/0x78 [ 5.530000] [<60042dcb>] ksys_unshare+0x179/0x345 [ 5.530000] [<60042fb4>] sys_unshare+0x1d/0x21 [ 5.530000] [<60025b0a>] handle_syscall+0x8e/0xbe [ 5.530000] [<6003c471>] userspace+0x3cf/0x536 [ 5.530000] [<600223e0>] fork_handler+0xa1/0xa3 [ 5.530000] ---[ end trace 02feadf6f35abdd7 ]--- -- Rgrds, legion ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-30 22:27 ` Yu Zhao (?) (?) @ 2021-10-06 2:12 ` Hillf Danton 2021-10-06 6:22 ` Yu Zhao 2021-10-07 13:28 ` Jordan Glover -1 siblings, 2 replies; 70+ messages in thread From: Hillf Danton @ 2021-10-06 2:12 UTC (permalink / raw) To: Yu Zhao, Alexey Gladkov Cc: Jordan Glover, ebiederm, LKML, linux-mm, containers On Thu, 30 Sep 2021 16:27:34 -0600 Yu Zhao wrote: >On Thu, Sep 30, 2021 at 7:06 AM Alexey Gladkov <legion@kernel.org> wrote: >> >> On Wed, Sep 29, 2021 at 09:39:06PM +0000, Jordan Glover wrote: >> > > I'm still investigating, but I would like to rule out one option. >> > > >> > > Could you check out the patch? >> > >> > >> > Thx, I added it to my kernel and will report in few days. >> > Does this patch try to fix the issue or make it easier to track? >> >> I suspect the error is caused by a race between allow_ucounts() and >> put_ucounts(). I think this patch could solve the problem. > >Thanks for your help. Still can reproduce the problem with the change suggested. > >[ 7761.885966] ================================================================== >[ 7761.893462] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 >[ 7761.899491] Write of size 8 at addr ffffff80c537b140 by task >kworker/u16:3/10303 >[ 7761.907110] >[ 7761.908668] CPU: 0 PID: 10303 Comm: kworker/u16:3 Not tainted >5.14.0-lockdep+ #1 >[ 7761.916289] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) >[ 7761.923021] Workqueue: netns cleanup_net >[ 7761.927106] Call trace: >[ 7761.929648] dump_backtrace+0x0/0x42c >[ 7761.933442] show_stack+0x24/0x30 >[ 7761.936878] dump_stack_lvl+0xd0/0x100 >[ 7761.940763] print_address_description+0x30/0x304 >[ 7761.945628] kasan_report+0x190/0x1d8 >[ 7761.949418] kasan_check_range+0x1ac/0x1bc >[ 7761.953655] __kasan_check_write+0x44/0x54 >[ 7761.957891] dec_ucount+0x50/0xd8 >[ 7761.961334] cleanup_net+0x630/0x718 >[ 7761.965036] process_one_work+0x7b4/0x10ec >[ 7761.969274] worker_thread+0x800/0xcf4 >[ 7761.973152] kthread+0x2a8/0x358 >[ 7761.976496] ret_from_fork+0x10/0x18 >[ 7761.980201] >[ 7761.981761] Allocated by task 4840: >[ 7761.985366] kasan_save_stack+0x38/0x68 >[ 7761.989342] __kasan_kmalloc+0x9c/0xb8 >[ 7761.993222] kmem_cache_alloc_trace+0x2a4/0x370 >[ 7761.997905] alloc_ucounts+0x150/0x374 >[ 7762.001787] set_cred_ucounts+0x198/0x248 >[ 7762.005935] __sys_setresuid+0x31c/0x4f8 >[ 7762.009993] __arm64_sys_setresuid+0x84/0x98 >[ 7762.014410] invoke_syscall+0xd4/0x2c8 >[ 7762.018292] el0_svc_common+0x124/0x200 >[ 7762.022265] do_el0_svc_compat+0x54/0x64 >[ 7762.026325] el0_svc_compat+0x24/0x34 >[ 7762.030124] el0t_32_sync_handler+0xc0/0xf0 >[ 7762.034451] el0t_32_sync+0x19c/0x1a0 >[ 7762.038241] >[ 7762.039799] Freed by task 0: >[ 7762.042778] kasan_save_stack+0x38/0x68 >[ 7762.046747] kasan_set_track+0x28/0x3c >[ 7762.050625] kasan_set_free_info+0x28/0x4c >[ 7762.054857] ____kasan_slab_free+0x118/0x164 >[ 7762.059277] __kasan_slab_free+0x18/0x28 >[ 7762.063339] kfree+0x2f8/0x500 >[ 7762.066505] put_ucounts+0x11c/0x134 >[ 7762.070209] put_cred_rcu+0x1bc/0x35c >[ 7762.074006] rcu_core+0xa68/0x1b20 >[ 7762.077538] rcu_core_si+0x1c/0x28 >[ 7762.081061] __do_softirq+0x4bc/0xedc >[ 7762.084851] >[ 7762.086401] The buggy address belongs to the object at ffffff80c537b100 >[ 7762.086401] which belongs to the cache kmalloc-256 of size 256 >[ 7762.099267] The buggy address is located 64 bytes inside of >[ 7762.099267] 256-byte region [ffffff80c537b100, ffffff80c537b200) >[ 7762.111248] The buggy address belongs to the page: >[ 7762.116185] page:fffffffe0314de00 refcount:1 mapcount:0 >mapping:0000000000000000 index:0xffffff80c537ad00 pfn:0x145378 >[ 7762.127180] head:fffffffe0314de00 order:3 compound_mapcount:0 >compound_pincount:0 >[ 7762.134881] flags: 0x8000000000010200(slab|head|zone=2) >[ 7762.140286] raw: 8000000000010200 fffffffe02799408 fffffffe02020808 >ffffff808000c980 >[ 7762.148263] raw: ffffff80c537ad00 0000000000200004 00000001ffffffff >0000000000000000 >[ 7762.156228] page dumped because: kasan: bad access detected >[ 7762.161974] >[ 7762.163532] Memory state around the buggy address: >[ 7762.168475] ffffff80c537b000: fc fc fc fc fc fc fc fc fc fc fc fc >fc fc fc fc >[ 7762.175915] ffffff80c537b080: fc fc fc fc fc fc fc fc fc fc fc fc >fc fc fc fc >[ 7762.183346] >ffffff80c537b100: fa fb fb fb fb fb fb fb fb fb fb fb >fb fb fb fb >[ 7762.190774] ^ >[ 7762.196258] ffffff80c537b180: fb fb fb fb fb fb fb fb fb fb fb fb >fb fb fb fb >[ 7762.203689] ffffff80c537b200: fc fc fc fc fc fc fc fc fc fc fc fc >fc fc fc fc >[ 7762.211125] ================================================================== Could you please check if it is due to count underflow? Given nothing wrong on the other side based on the efforts "We looked through the users of put_ucounts and we don't see any obvious buggy users that would be freeing the data structure early." Thanks Hillf --- linux-5.14.4/kernel/ucount.c +++ b/kernel/ucount.c @@ -152,7 +152,10 @@ static void hlist_add_ucounts(struct uco struct ucounts *get_ucounts(struct ucounts *ucounts) { - if (ucounts && atomic_add_negative(1, &ucounts->count)) { + if (!ucounts) + return NULL; + WARN_ON(!atomic_read(&ucounts->count)); + if (atomic_add_negative(1, &ucounts->count)) { put_ucounts(ucounts); ucounts = NULL; } -- ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-06 2:12 ` Hillf Danton @ 2021-10-06 6:22 ` Yu Zhao 2021-10-07 13:28 ` Jordan Glover 1 sibling, 0 replies; 70+ messages in thread From: Yu Zhao @ 2021-10-06 6:22 UTC (permalink / raw) To: Hillf Danton, Jordan Glover Cc: Alexey Gladkov, Eric W. Biederman, LKML, Linux-MM, containers\@lists.linux-foundation.org On Tue, Oct 5, 2021 at 8:12 PM Hillf Danton <hdanton@sina.com> wrote: > > On Thu, 30 Sep 2021 16:27:34 -0600 Yu Zhao wrote: > >On Thu, Sep 30, 2021 at 7:06 AM Alexey Gladkov <legion@kernel.org> wrote: > >> > >> On Wed, Sep 29, 2021 at 09:39:06PM +0000, Jordan Glover wrote: > >> > > I'm still investigating, but I would like to rule out one option. > >> > > > >> > > Could you check out the patch? > >> > > >> > > >> > Thx, I added it to my kernel and will report in few days. > >> > Does this patch try to fix the issue or make it easier to track? > >> > >> I suspect the error is caused by a race between allow_ucounts() and > >> put_ucounts(). I think this patch could solve the problem. > > > >Thanks for your help. Still can reproduce the problem with the change suggested. > > > >[ 7761.885966] ================================================================== > >[ 7761.893462] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 > >[ 7761.899491] Write of size 8 at addr ffffff80c537b140 by task > >kworker/u16:3/10303 > >[ 7761.907110] > >[ 7761.908668] CPU: 0 PID: 10303 Comm: kworker/u16:3 Not tainted > >5.14.0-lockdep+ #1 > >[ 7761.916289] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) > >[ 7761.923021] Workqueue: netns cleanup_net > >[ 7761.927106] Call trace: > >[ 7761.929648] dump_backtrace+0x0/0x42c > >[ 7761.933442] show_stack+0x24/0x30 > >[ 7761.936878] dump_stack_lvl+0xd0/0x100 > >[ 7761.940763] print_address_description+0x30/0x304 > >[ 7761.945628] kasan_report+0x190/0x1d8 > >[ 7761.949418] kasan_check_range+0x1ac/0x1bc > >[ 7761.953655] __kasan_check_write+0x44/0x54 > >[ 7761.957891] dec_ucount+0x50/0xd8 > >[ 7761.961334] cleanup_net+0x630/0x718 > >[ 7761.965036] process_one_work+0x7b4/0x10ec > >[ 7761.969274] worker_thread+0x800/0xcf4 > >[ 7761.973152] kthread+0x2a8/0x358 > >[ 7761.976496] ret_from_fork+0x10/0x18 > >[ 7761.980201] > >[ 7761.981761] Allocated by task 4840: > >[ 7761.985366] kasan_save_stack+0x38/0x68 > >[ 7761.989342] __kasan_kmalloc+0x9c/0xb8 > >[ 7761.993222] kmem_cache_alloc_trace+0x2a4/0x370 > >[ 7761.997905] alloc_ucounts+0x150/0x374 > >[ 7762.001787] set_cred_ucounts+0x198/0x248 > >[ 7762.005935] __sys_setresuid+0x31c/0x4f8 > >[ 7762.009993] __arm64_sys_setresuid+0x84/0x98 > >[ 7762.014410] invoke_syscall+0xd4/0x2c8 > >[ 7762.018292] el0_svc_common+0x124/0x200 > >[ 7762.022265] do_el0_svc_compat+0x54/0x64 > >[ 7762.026325] el0_svc_compat+0x24/0x34 > >[ 7762.030124] el0t_32_sync_handler+0xc0/0xf0 > >[ 7762.034451] el0t_32_sync+0x19c/0x1a0 > >[ 7762.038241] > >[ 7762.039799] Freed by task 0: > >[ 7762.042778] kasan_save_stack+0x38/0x68 > >[ 7762.046747] kasan_set_track+0x28/0x3c > >[ 7762.050625] kasan_set_free_info+0x28/0x4c > >[ 7762.054857] ____kasan_slab_free+0x118/0x164 > >[ 7762.059277] __kasan_slab_free+0x18/0x28 > >[ 7762.063339] kfree+0x2f8/0x500 > >[ 7762.066505] put_ucounts+0x11c/0x134 > >[ 7762.070209] put_cred_rcu+0x1bc/0x35c > >[ 7762.074006] rcu_core+0xa68/0x1b20 > >[ 7762.077538] rcu_core_si+0x1c/0x28 > >[ 7762.081061] __do_softirq+0x4bc/0xedc > >[ 7762.084851] > >[ 7762.086401] The buggy address belongs to the object at ffffff80c537b100 > >[ 7762.086401] which belongs to the cache kmalloc-256 of size 256 > >[ 7762.099267] The buggy address is located 64 bytes inside of > >[ 7762.099267] 256-byte region [ffffff80c537b100, ffffff80c537b200) > >[ 7762.111248] The buggy address belongs to the page: > >[ 7762.116185] page:fffffffe0314de00 refcount:1 mapcount:0 > >mapping:0000000000000000 index:0xffffff80c537ad00 pfn:0x145378 > >[ 7762.127180] head:fffffffe0314de00 order:3 compound_mapcount:0 > >compound_pincount:0 > >[ 7762.134881] flags: 0x8000000000010200(slab|head|zone=2) > >[ 7762.140286] raw: 8000000000010200 fffffffe02799408 fffffffe02020808 > >ffffff808000c980 > >[ 7762.148263] raw: ffffff80c537ad00 0000000000200004 00000001ffffffff > >0000000000000000 > >[ 7762.156228] page dumped because: kasan: bad access detected > >[ 7762.161974] > >[ 7762.163532] Memory state around the buggy address: > >[ 7762.168475] ffffff80c537b000: fc fc fc fc fc fc fc fc fc fc fc fc > >fc fc fc fc > >[ 7762.175915] ffffff80c537b080: fc fc fc fc fc fc fc fc fc fc fc fc > >fc fc fc fc > >[ 7762.183346] >ffffff80c537b100: fa fb fb fb fb fb fb fb fb fb fb fb > >fb fb fb fb > >[ 7762.190774] ^ > >[ 7762.196258] ffffff80c537b180: fb fb fb fb fb fb fb fb fb fb fb fb > >fb fb fb fb > >[ 7762.203689] ffffff80c537b200: fc fc fc fc fc fc fc fc fc fc fc fc > >fc fc fc fc > >[ 7762.211125] ================================================================== > > Could you please check if it is due to count underflow? Given nothing wrong > on the other side based on the efforts > "We looked through the users of put_ucounts and we don't see any obvious buggy > users that would be freeing the data structure early." Thanks, Hillf. Still can reproduce the problem without triggering the warning. [ 7965.795189] ================================================================== [ 7965.802642] BUG: KASAN: use-after-free in dec_ucount+0x50/0xd8 [ 7965.808653] Write of size 8 at addr ffffff8090294920 by task kworker/7:0/7002 [ 7965.815990] [ 7965.817536] CPU: 7 PID: 7002 Comm: kworker/7:0 Not tainted 5.14.0-lockdep+ #2 [ 7965.824870] Hardware name: Google Lazor (rev3+) with KB Backlight (DT) [ 7965.831576] Workqueue: events free_user_ns [ 7965.835810] Call trace: [ 7965.838338] dump_backtrace+0x0/0x42c [ 7965.842119] show_stack+0x24/0x30 [ 7965.845540] dump_stack_lvl+0xd0/0x100 [ 7965.849401] print_address_description+0x30/0x304 [ 7965.854248] kasan_report+0x190/0x1d8 [ 7965.858016] kasan_check_range+0x1ac/0x1bc [ 7965.862236] __kasan_check_write+0x44/0x54 [ 7965.866463] dec_ucount+0x50/0xd8 [ 7965.869876] free_user_ns+0x1b0/0x288 [ 7965.873645] process_one_work+0x7b4/0x10ec [ 7965.877871] worker_thread+0x800/0xcf4 [ 7965.881729] kthread+0x2a8/0x358 [ 7965.885057] ret_from_fork+0x10/0x18 [ 7965.888746] [ 7965.890288] Allocated by task 19167: [ 7965.893976] kasan_save_stack+0x38/0x68 [ 7965.897923] __kasan_kmalloc+0x9c/0xb8 [ 7965.901782] __kmalloc+0x2c8/0x3c0 [ 7965.905287] kvmalloc_node+0x64/0x104 [ 7965.909065] v4l2_ctrl_new+0x478/0xc6c [ 7965.912923] v4l2_ctrl_new_std+0x280/0x374 [ 7965.917136] venc_ctrl_init+0x4c4/0x7c8 [venus_enc] [ 7965.922170] venc_open+0x218/0x668 [venus_enc] [ 7965.926748] v4l2_open+0x158/0x234 [ 7965.930255] chrdev_open+0x17c/0x37c [ 7965.933942] do_dentry_open+0x504/0xa44 [ 7965.937889] vfs_open+0x84/0x98 [ 7965.941124] path_openat+0x1980/0x1fac [ 7965.944991] do_filp_open+0x19c/0x2c0 [ 7965.948767] do_sys_openat2+0xb8/0x298 [ 7965.952628] do_sys_open+0x124/0x15c [ 7965.956309] __arm64_compat_sys_openat+0xa4/0xbc [ 7965.961060] invoke_syscall+0xd4/0x2c8 [ 7965.964920] el0_svc_common+0x124/0x200 [ 7965.968873] do_el0_svc_compat+0x54/0x64 [ 7965.972915] el0_svc_compat+0x24/0x34 [ 7965.976688] el0t_32_sync_handler+0xc0/0xf0 [ 7965.980999] el0t_32_sync+0x19c/0x1a0 [ 7965.984781] [ 7965.986330] Last potentially related work creation: [ 7965.991342] kasan_save_stack+0x38/0x68 [ 7965.995294] kasan_record_aux_stack+0xdc/0x108 [ 7965.999866] insert_work+0x60/0x22c [ 7966.003458] __queue_work+0xae8/0xe74 [ 7966.007223] queue_work_on+0x100/0x148 [ 7966.011076] drm_atomic_helper_commit+0x18c/0x1f4 [ 7966.015917] drm_atomic_nonblocking_commit+0xc4/0xdc [ 7966.021018] drm_mode_atomic_ioctl+0x89c/0xaa0 [ 7966.025590] drm_ioctl_kernel+0x15c/0x260 [ 7966.029720] drm_ioctl+0x460/0x828 [ 7966.033229] drm_compat_ioctl+0x1bc/0x230 [ 7966.037370] __arm64_compat_sys_ioctl+0x1b0/0x1c4 [ 7966.042216] invoke_syscall+0xd4/0x2c8 [ 7966.046071] el0_svc_common+0x124/0x200 [ 7966.050015] do_el0_svc_compat+0x54/0x64 [ 7966.054053] el0_svc_compat+0x24/0x34 [ 7966.057819] el0t_32_sync_handler+0xc0/0xf0 [ 7966.062119] el0t_32_sync+0x19c/0x1a0 [ 7966.065884] [ 7966.067424] Second to last potentially related work creation: [ 7966.073329] kasan_save_stack+0x38/0x68 [ 7966.077271] kasan_record_aux_stack+0xdc/0x108 [ 7966.081837] insert_work+0x60/0x22c [ 7966.085434] __queue_work+0xae8/0xe74 [ 7966.089202] queue_work_on+0x100/0x148 [ 7966.093060] drm_atomic_helper_commit+0x18c/0x1f4 [ 7966.097900] drm_atomic_nonblocking_commit+0xc4/0xdc [ 7966.103000] drm_mode_atomic_ioctl+0x89c/0xaa0 [ 7966.107572] drm_ioctl_kernel+0x15c/0x260 [ 7966.111697] drm_ioctl+0x460/0x828 [ 7966.115200] drm_compat_ioctl+0x1bc/0x230 [ 7966.119323] __arm64_compat_sys_ioctl+0x1b0/0x1c4 [ 7966.124161] invoke_syscall+0xd4/0x2c8 [ 7966.128016] el0_svc_common+0x124/0x200 [ 7966.131962] do_el0_svc_compat+0x54/0x64 [ 7966.135993] el0_svc_compat+0x24/0x34 [ 7966.139762] el0t_32_sync_handler+0xc0/0xf0 [ 7966.144067] el0t_32_sync+0x19c/0x1a0 [ 7966.147837] [ 7966.149374] The buggy address belongs to the object at ffffff8090294900 [ 7966.149374] which belongs to the cache kmalloc-256 of size 256 [ 7966.162218] The buggy address is located 32 bytes inside of [ 7966.162218] 256-byte region [ffffff8090294900, ffffff8090294a00) [ 7966.174174] The buggy address belongs to the page: [ 7966.179101] page:fffffffe0240a400 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffff8090294900 pfn:0x110290 [ 7966.190079] head:fffffffe0240a400 order:3 compound_mapcount:0 compound_pincount:0 [ 7966.197760] flags: 0x8000000000010200(slab|head|zone=2) [ 7966.203137] raw: 8000000000010200 fffffffe002f3c08 fffffffe023f9008 ffffff808000c980 [ 7966.211086] raw: ffffff8090294900 0000000000200005 00000001ffffffff 0000000000000000 [ 7966.219034] page dumped because: kasan: bad access detected [ 7966.224763] [ 7966.226300] Memory state around the buggy address: [ 7966.231228] ffffff8090294800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7966.238641] ffffff8090294880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7966.246055] >ffffff8090294900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7966.253466] ^ [ 7966.257849] ffffff8090294980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7966.265267] ffffff8090294a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7966.272678] ================================================================== ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-06 2:12 ` Hillf Danton 2021-10-06 6:22 ` Yu Zhao @ 2021-10-07 13:28 ` Jordan Glover 2021-10-10 11:26 ` Hillf Danton 1 sibling, 1 reply; 70+ messages in thread From: Jordan Glover @ 2021-10-07 13:28 UTC (permalink / raw) To: Hillf Danton Cc: Yu Zhao, Alexey Gladkov, ebiederm, LKML, linux-mm, containers On Wednesday, October 6th, 2021 at 2:12 AM, Hillf Danton <hdanton@sina.com> wrote: > Could you please check if it is due to count underflow? Given nothing wrong > > on the other side based on the efforts > > "We looked through the users of put_ucounts and we don't see any obvious buggy > > users that would be freeing the data structure early." > > Thanks > > Hillf > > --- linux-5.14.4/kernel/ucount.c > > +++ b/kernel/ucount.c > > @@ -152,7 +152,10 @@ static void hlist_add_ucounts(struct uco > > struct ucounts *get_ucounts(struct ucounts *ucounts) > > { > > - if (ucounts && atomic_add_negative(1, &ucounts->count)) { > > - if (!ucounts) > > - return NULL; > > > - WARN_ON(!atomic_read(&ucounts->count)); > > - if (atomic_add_negative(1, &ucounts->count)) { > > put_ucounts(ucounts); > ucounts = NULL; > > > } > > -- > For me above patch changed slightly the printed output. Now the warning comes from 'cleanup_net' instead of 'free_user_ns'. My system was also still responsive after the bug occurred which didn't happen previously. I can't say if this means anything or if this is result of above patch or instability of my reproducer. ------------[ cut here ]------------ WARNING: CPU: 2 PID: 27643 at kernel/ucount.c:256 dec_ucount+0x43/0x50 Modules linked in: <cut> CPU: 2 PID: 27643 Comm: kworker/u8:3 Not tainted 5.14.9 #1 0274f3d0712a6dadc9a2cf8341ae333de732a31a Workqueue: netns cleanup_net RIP: 0010:dec_ucount+0x43/0x50 Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 fd fc ff ff <0f> 0b eb e7 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000072a95d359030 CR3: 000000000b20e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: cleanup_net+0x2e2/0x370 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 ---[ end trace e5fdc3317f00d0e8 ]--- BUG: kernel NULL pointer dereference, address: 00000000000001e8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 2 PID: 27643 Comm: kworker/u8:3 Tainted: G W 5.14.9 #1 0274f3d0712a6dadc9a2cf8341ae333de732a31a Workqueue: netns cleanup_net RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 fd fc ff ff 0f 0b eb e7 66 RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 000000000b20e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: cleanup_net+0x2e2/0x370 process_one_work+0x1e1/0x380 worker_thread+0x50/0x3a0 ? rescuer_thread+0x360/0x360 kthread+0x127/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 Modules linked in: <cut> CR2: 00000000000001e8 ---[ end trace e5fdc3317f00d0e9 ]--- RIP: 0010:dec_ucount+0x32/0x50 Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 fd fc ff ff 0f 0b eb e7 66 RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001e8 CR3: 000000000b20e005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-10-07 13:28 ` Jordan Glover @ 2021-10-10 11:26 ` Hillf Danton 0 siblings, 0 replies; 70+ messages in thread From: Hillf Danton @ 2021-10-10 11:26 UTC (permalink / raw) To: Jordan Glover Cc: Yu Zhao, Alexey Gladkov, ebiederm, LKML, linux-mm, containers On Thu, 07 Oct 2021 13:28:29 +0000 Jordan Glover wrote: > >For me above patch changed slightly the printed output. Now the warning >comes from 'cleanup_net' instead of 'free_user_ns'. My system was also >still responsive after the bug occurred which didn't happen previously. >I can't say if this means anything or if this is result of above patch >or instability of my reproducer. Thanks for your report. It is the same issue as reported before and my patch did not help. Hillf > >------------[ cut here ]------------ >WARNING: CPU: 2 PID: 27643 at kernel/ucount.c:256 dec_ucount+0x43/0x50 >Modules linked in: <cut> >CPU: 2 PID: 27643 Comm: kworker/u8:3 Not tainted 5.14.9 #1 0274f3d0712a6dad= >c9a2cf8341ae333de732a31a >Workqueue: netns cleanup_net >RIP: 0010:dec_ucount+0x43/0x50 >Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b = >41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 fd fc ff ff <0f> 0b eb e7 66 0= >f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 >RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 >RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 >RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 >RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 >R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 >R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 >FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:000000000000000= >0 >CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >CR2: 000072a95d359030 CR3: 000000000b20e005 CR4: 00000000003706e0 >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >Call Trace: > cleanup_net+0x2e2/0x370 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 >---[ end trace e5fdc3317f00d0e8 ]--- >BUG: kernel NULL pointer dereference, address: 00000000000001e8 >#PF: supervisor read access in kernel mode >#PF: error_code(0x0000) - not-present page >PGD 0 P4D 0 >Oops: 0000 [#1] SMP PTI >CPU: 2 PID: 27643 Comm: kworker/u8:3 Tainted: G W 5.14.9 #1 = >0274f3d0712a6dadc9a2cf8341ae333de732a31a >Workqueue: netns cleanup_net >RIP: 0010:dec_ucount+0x32/0x50 >Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 = >89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 0= >0 00 48 85 c9 75 d9 e9 fd fc ff ff 0f 0b eb e7 66 >RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 >RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 >RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 >RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 >R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 >R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 >FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:000000000000000= >0 >CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >CR2: 00000000000001e8 CR3: 000000000b20e005 CR4: 00000000003706e0 >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >Call Trace: > cleanup_net+0x2e2/0x370 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 >Modules linked in: <cut> >CR2: 00000000000001e8 >---[ end trace e5fdc3317f00d0e9 ]--- >RIP: 0010:dec_ucount+0x32/0x50 >Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 48 = >89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 01 0= >0 00 48 85 c9 75 d9 e9 fd fc ff ff 0f 0b eb e7 66 >RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 >RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 >RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 >RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 >R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 >R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 >FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:000000000000000= >0 >CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >CR2: 00000000000001e8 CR3: 000000000b20e005 CR4: 00000000003706e0 >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference 2021-09-29 17:36 ` Alexey Gladkov @ 2021-10-03 19:37 ` Jordan Glover -1 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-10-03 19:37 UTC (permalink / raw) To: Alexey Gladkov Cc: ebiederm, LKML, linux-mm\\@kvack.org, containers\\@lists.linux-foundation.org, Yu Zhao On Wednesday, September 29th, 2021 at 5:36 PM, Alexey Gladkov <legion@kernel.org> wrote: > On Tue, Sep 28, 2021 at 01:40:48PM +0000, Jordan Glover wrote: > > > On Thursday, September 16th, 2021 at 5:30 PM, ebiederm@xmission.com wrote: > > > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > > > > > Heh, it jut happened again. This time closing firefox alone had such > > > > > > > > effect: > > > > > > Ok. It looks like he have a couple of folks seeing issues here. > > > > > > I thought we had all of the issues sorted out for the release of v5.14, > > > > > > but it looks like there is still some little bug left. > > > > > > If Alex doesn't beat me to it I will see if I can come up with a > > > > > > debugging patch to make it easy to help track down where the reference > > > > > > count is going wrong. It will be a little bit as my brain is mush at > > > > > > the moment. > > > > > > Eric > > > > As the issue persist in 5.14.7 I would be very interested in such patch. > > > > For now the thing is mostly reproducible when I close several tabs in ff then > > > > close the browser in short period of time. When I close tabs then wait out > > > > a bit then close the browser it doesn't happen so I guess some interrupted > > > > cleanup triggers it. > > I'm still investigating, but I would like to rule out one option. > > Could you check out the patch? > > diff --git a/kernel/ucount.c b/kernel/ucount.c > > index bb51849e6375..f23f906f4f62 100644 > > --- a/kernel/ucount.c > > +++ b/kernel/ucount.c > > @@ -201,11 +201,14 @@ void put_ucounts(struct ucounts *ucounts) > > { > > unsigned long flags; > > - if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { > > > > - spin_lock_irqsave(&ucounts_lock, flags); > > > - if (atomic_dec_and_test(&ucounts->count)) { > > hlist_del_init(&ucounts->node); > > spin_unlock_irqrestore(&ucounts_lock, flags); > kfree(ucounts); > > > - return; > } > > > - spin_unlock_irqrestore(&ucounts_lock, flags); > > > > } > > static inline bool atomic_long_inc_below(atomic_long_t *v, int u) > > --------------------------------------------------------------------- > > Rgrds, legion I'm still able to reproduce the issue with above patch although situation changed/improved a bit as now I have to close tabs and browser really fast to hit it which means it's more unlikely to happen during real usage. On the other hand the kernel logging cuts off much earlier, just after few lines: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 20387 at kernel/ucount.c:256 dec_ucount+0x43/0x50 Modules linked in: ... Jordan ^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: linux 5.14.3: free_user_ns causes NULL pointer dereference @ 2021-10-03 19:37 ` Jordan Glover 0 siblings, 0 replies; 70+ messages in thread From: Jordan Glover @ 2021-10-03 19:37 UTC (permalink / raw) To: Alexey Gladkov Cc: ebiederm, LKML, linux-mm\\@kvack.org, containers\\@lists.linux-foundation.org, Yu Zhao On Wednesday, September 29th, 2021 at 5:36 PM, Alexey Gladkov <legion@kernel.org> wrote: > On Tue, Sep 28, 2021 at 01:40:48PM +0000, Jordan Glover wrote: > > > On Thursday, September 16th, 2021 at 5:30 PM, ebiederm@xmission.com wrote: > > > > > Jordan Glover Golden_Miller83@protonmail.ch writes: > > > > > > > On Wednesday, September 15th, 2021 at 10:42 PM, Jordan Glover Golden_Miller83@protonmail.ch wrote: > > > > > > > > > I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious. > > > > > > > > > > Maybe it's some random fluke. I'll reply if I hit it again. > > > > > > > > Heh, it jut happened again. This time closing firefox alone had such > > > > > > > > effect: > > > > > > Ok. It looks like he have a couple of folks seeing issues here. > > > > > > I thought we had all of the issues sorted out for the release of v5.14, > > > > > > but it looks like there is still some little bug left. > > > > > > If Alex doesn't beat me to it I will see if I can come up with a > > > > > > debugging patch to make it easy to help track down where the reference > > > > > > count is going wrong. It will be a little bit as my brain is mush at > > > > > > the moment. > > > > > > Eric > > > > As the issue persist in 5.14.7 I would be very interested in such patch. > > > > For now the thing is mostly reproducible when I close several tabs in ff then > > > > close the browser in short period of time. When I close tabs then wait out > > > > a bit then close the browser it doesn't happen so I guess some interrupted > > > > cleanup triggers it. > > I'm still investigating, but I would like to rule out one option. > > Could you check out the patch? > > diff --git a/kernel/ucount.c b/kernel/ucount.c > > index bb51849e6375..f23f906f4f62 100644 > > --- a/kernel/ucount.c > > +++ b/kernel/ucount.c > > @@ -201,11 +201,14 @@ void put_ucounts(struct ucounts *ucounts) > > { > > unsigned long flags; > > - if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { > > > > - spin_lock_irqsave(&ucounts_lock, flags); > > > - if (atomic_dec_and_test(&ucounts->count)) { > > hlist_del_init(&ucounts->node); > > spin_unlock_irqrestore(&ucounts_lock, flags); > kfree(ucounts); > > > - return; > } > > > - spin_unlock_irqrestore(&ucounts_lock, flags); > > > > } > > static inline bool atomic_long_inc_below(atomic_long_t *v, int u) > > --------------------------------------------------------------------- > > Rgrds, legion I'm still able to reproduce the issue with above patch although situation changed/improved a bit as now I have to close tabs and browser really fast to hit it which means it's more unlikely to happen during real usage. On the other hand the kernel logging cuts off much earlier, just after few lines: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 20387 at kernel/ucount.c:256 dec_ucount+0x43/0x50 Modules linked in: ... Jordan ^ permalink raw reply [flat|nested] 70+ messages in thread
end of thread, other threads:[~2021-11-06 20:23 UTC | newest] Thread overview: 70+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-09-15 19:49 linux 5.14.3: free_user_ns causes NULL pointer dereference Jordan Glover 2021-09-15 19:49 ` Jordan Glover 2021-09-15 21:02 ` Eric W. Biederman 2021-09-15 21:02 ` Eric W. Biederman 2021-09-15 22:42 ` Jordan Glover 2021-09-15 22:42 ` Jordan Glover 2021-09-15 23:44 ` Yu Zhao 2021-09-15 23:44 ` Yu Zhao 2021-09-17 16:15 ` Eric W. Biederman 2021-09-17 16:15 ` Eric W. Biederman 2021-09-17 18:45 ` Yu Zhao 2021-09-17 18:45 ` Yu Zhao 2021-09-15 23:47 ` Jordan Glover 2021-09-15 23:47 ` Jordan Glover 2021-09-16 17:30 ` Eric W. Biederman 2021-09-16 17:30 ` Eric W. Biederman 2021-09-16 19:14 ` Alexey Gladkov 2021-09-16 19:14 ` Alexey Gladkov 2021-09-28 13:40 ` Jordan Glover 2021-09-28 13:40 ` Jordan Glover 2021-09-29 17:36 ` Alexey Gladkov 2021-09-29 17:36 ` Alexey Gladkov 2021-09-29 21:39 ` Jordan Glover 2021-09-29 21:39 ` Jordan Glover 2021-09-30 13:06 ` Alexey Gladkov 2021-09-30 22:27 ` Yu Zhao 2021-09-30 22:27 ` Yu Zhao 2021-10-04 17:10 ` Eric W. Biederman 2021-10-04 17:19 ` Eric W. Biederman 2021-10-04 21:34 ` Yu Zhao 2021-10-06 7:57 ` Rune Kleveland 2021-10-10 8:59 ` Rune Kleveland 2021-10-11 13:09 ` Hillf Danton 2021-10-12 17:31 ` Eric W. Biederman 2021-10-15 22:10 ` [CFT][PATCH] ucounts: Fix signal ucount refcounting Eric W. Biederman 2021-10-15 23:09 ` Alexey Gladkov 2021-10-16 17:34 ` Eric W. Biederman 2021-10-17 19:35 ` Yu Zhao 2021-10-18 15:35 ` Eric W. Biederman 2021-10-16 2:08 ` Hillf Danton 2021-10-16 18:00 ` Eric W. Biederman 2021-10-17 16:47 ` Rune Kleveland 2021-10-18 6:25 ` Yu Zhao 2021-10-18 10:31 ` Jordan Glover 2021-10-18 16:06 ` [PATCH v2] " Eric W. Biederman 2021-10-18 17:21 ` [PATCH 0/3] ucounts: misc fixes Eric W. Biederman 2021-10-18 17:23 ` [PATCH 1/3] ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds Eric W. Biederman 2021-10-18 17:23 ` [PATCH 2/3] ucounts: Proper error handling in set_cred_ucounts Eric W. Biederman 2021-10-18 17:24 ` [PATCH 3/3] ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring Eric W. Biederman 2021-10-24 17:36 ` kernel test robot 2021-10-25 14:13 ` Eric W. Biederman 2021-11-06 5:05 ` kernel test robot 2021-11-06 5:05 ` kernel test robot 2021-11-06 20:22 ` kernel test robot 2021-11-06 20:22 ` kernel test robot 2021-10-18 17:54 ` [PATCH 0/4] ucounts: misc cleanups Eric W. Biederman 2021-10-18 17:55 ` [PATCH 1/4] ucounts: In set_cred_ucounts assume new->ucounts is non-NULL Eric W. Biederman 2021-10-18 17:56 ` [PATCH 2/4] ucounts: Remove unnecessary test for NULL ucount in get_ucounts Eric W. Biederman 2021-10-18 17:56 ` [PATCH 3/4] ucounts: Add get_ucounts_or_wrap for clarity Eric W. Biederman 2021-10-18 17:57 ` [PATCH 4/4] ucounts: Use atomic_long_sub_return " Eric W. Biederman 2021-10-18 22:29 ` [PATCH 0/4] ucounts: misc cleanups Yu Zhao 2021-10-18 22:28 ` [PATCH 0/3] ucounts: misc fixes Yu Zhao 2021-10-18 22:26 ` [PATCH v2] ucounts: Fix signal ucount refcounting Yu Zhao 2021-10-11 13:39 ` linux 5.14.3: free_user_ns causes NULL pointer dereference Alexey Gladkov 2021-10-06 2:12 ` Hillf Danton 2021-10-06 6:22 ` Yu Zhao 2021-10-07 13:28 ` Jordan Glover 2021-10-10 11:26 ` Hillf Danton 2021-10-03 19:37 ` Jordan Glover 2021-10-03 19:37 ` Jordan Glover
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.