Merge 5.10.108 into android12-5.10-lts
Changes in 5.10.108 crypto: qcom-rng - ensure buffer for generate is completely filled ocfs2: fix crash when initialize filecheck kobj fails mm: swap: get rid of livelock in swapin readahead efi: fix return value of __setup handlers vsock: each transport cycles only on its own sockets esp6: fix check on ipv6_skip_exthdr's return value net: phy: marvell: Fix invalid comparison in the resume and suspend functions net/packet: fix slab-out-of-bounds access in packet_recvmsg() atm: eni: Add check for dma_map_single hv_netvsc: Add check for kvmalloc_array drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() net: dsa: Add missing of_node_put() in dsa_port_parse_of net: phy: mscc: Add MODULE_FIRMWARE macros bnx2x: fix built-in kernel driver load failure net: bcmgenet: skip invalid partial checksums net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload arm64: fix clang warning about TRAMP_VALIAS usb: gadget: rndis: prevent integer overflow in rndis_set_response() usb: gadget: Fix use-after-free bug by not setting udc->dev.driver usb: usbtmc: Fix bug in pipe direction for control transfers scsi: mpt3sas: Page fault in reply q processing Input: aiptek - properly check endpoint type perf symbols: Fix symbol size calculation condition net: usb: Correct PHY handling of smsc95xx net: usb: Correct reset handling of smsc95xx smsc95xx: Ignore -ENODEV errors when device is unplugged esp: Fix possible buffer overflow in ESP transformation Revert "selftests/bpf: Add test for bpf_timer overwriting crash" Linux 5.10.108 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I618f4ec34bfcb8c11821276c5105c46d3aace78c
This commit is contained in:
@@ -1,32 +0,0 @@
|
||||
// SPDX-License-Identifier: GPL-2.0
|
||||
#include <test_progs.h>
|
||||
#include "timer_crash.skel.h"
|
||||
|
||||
enum {
|
||||
MODE_ARRAY,
|
||||
MODE_HASH,
|
||||
};
|
||||
|
||||
static void test_timer_crash_mode(int mode)
|
||||
{
|
||||
struct timer_crash *skel;
|
||||
|
||||
skel = timer_crash__open_and_load();
|
||||
if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load"))
|
||||
return;
|
||||
skel->bss->pid = getpid();
|
||||
skel->bss->crash_map = mode;
|
||||
if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach"))
|
||||
goto end;
|
||||
usleep(1);
|
||||
end:
|
||||
timer_crash__destroy(skel);
|
||||
}
|
||||
|
||||
void test_timer_crash(void)
|
||||
{
|
||||
if (test__start_subtest("array"))
|
||||
test_timer_crash_mode(MODE_ARRAY);
|
||||
if (test__start_subtest("hash"))
|
||||
test_timer_crash_mode(MODE_HASH);
|
||||
}
|
@@ -1,54 +0,0 @@
|
||||
// SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
#include <vmlinux.h>
|
||||
#include <bpf/bpf_tracing.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
|
||||
struct map_elem {
|
||||
struct bpf_timer timer;
|
||||
struct bpf_spin_lock lock;
|
||||
};
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_ARRAY);
|
||||
__uint(max_entries, 1);
|
||||
__type(key, int);
|
||||
__type(value, struct map_elem);
|
||||
} amap SEC(".maps");
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_HASH);
|
||||
__uint(max_entries, 1);
|
||||
__type(key, int);
|
||||
__type(value, struct map_elem);
|
||||
} hmap SEC(".maps");
|
||||
|
||||
int pid = 0;
|
||||
int crash_map = 0; /* 0 for amap, 1 for hmap */
|
||||
|
||||
SEC("fentry/do_nanosleep")
|
||||
int sys_enter(void *ctx)
|
||||
{
|
||||
struct map_elem *e, value = {};
|
||||
void *map = crash_map ? (void *)&hmap : (void *)&amap;
|
||||
|
||||
if (bpf_get_current_task_btf()->tgid != pid)
|
||||
return 0;
|
||||
|
||||
*(void **)&value = (void *)0xdeadcaf3;
|
||||
|
||||
bpf_map_update_elem(map, &(int){0}, &value, 0);
|
||||
/* For array map, doing bpf_map_update_elem will do a
|
||||
* check_and_free_timer_in_array, which will trigger the crash if timer
|
||||
* pointer was overwritten, for hmap we need to use bpf_timer_cancel.
|
||||
*/
|
||||
if (crash_map == 1) {
|
||||
e = bpf_map_lookup_elem(map, &(int){0});
|
||||
if (!e)
|
||||
return 0;
|
||||
bpf_timer_cancel(&e->timer);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
Reference in New Issue
Block a user