Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit a3c6a992 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'ASB-2023-06-05_4.19-stable' of... 

Merge tag 'ASB-2023-06-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona

https://source.android.com/docs/security/bulletin/2023-06-01

* tag 'ASB-2023-06-05_4.19-stable' of https://android.googlesource.com/kernel/common:
  UPSTREAM: ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
  UPSTREAM: ext4: fix invalid free tracking in ext4_xattr_move_to_block()
  ANDROID: incremental fs: Evict inodes before freeing mount data
  Revert "Revert "mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse""

Change-Id: I050bde567586e4f21af411a4ded122f571f55c28
parents 899c0059 fee4b79c

android/abi_gki_aarch64.xml

+1729 −1725

File changed.

Preview size limit exceeded, changes collapsed.

fs/ext4/super.c

+2 −4
Original line number Diff line number Diff line
@@ -2530,11 +2530,9 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, 
	crc = crc16(crc, (__u8 *)gdp, offset);

	offset += sizeof(gdp->bg_checksum); /* skip checksum */

	/* for checksum of struct ext4_group_desc do the rest...*/

	if (ext4_has_feature_64bit(sb) &&

	    offset < le16_to_cpu(sbi->s_es->s_desc_size))

	if (ext4_has_feature_64bit(sb) && offset < sbi->s_desc_size)

		crc = crc16(crc, (__u8 *)gdp + offset,

			    le16_to_cpu(sbi->s_es->s_desc_size) -

				offset);

			    sbi->s_desc_size - offset);



out:

	return cpu_to_le16(crc);

fs/ext4/xattr.c

+3 −2
Original line number Diff line number Diff line
@@ -2573,6 +2573,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, 
		.in_inode = !!entry->e_value_inum,

	};

	struct ext4_xattr_ibody_header *header = IHDR(inode, raw_inode);

	int needs_kvfree = 0;

	int error;



	is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS);
@@ -2595,7 +2596,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, 
			error = -ENOMEM;

			goto out;

		}



		needs_kvfree = 1;

		error = ext4_xattr_inode_get(inode, entry, buffer, value_size);

		if (error)

			goto out;
@@ -2634,7 +2635,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, 


out:

	kfree(b_entry_name);

	if (entry->e_value_inum && buffer)

	if (needs_kvfree && buffer)

		kvfree(buffer);

	if (is)

		brelse(is->iloc.bh);

fs/incfs/main.c

+10 −0
Original line number Diff line number Diff line
@@ -30,6 +30,15 @@ static ssize_t corefs_show(struct kobject *kobj, 


static struct kobj_attribute corefs_attr = __ATTR_RO(corefs);



static ssize_t bugfix_inode_eviction_show(struct kobject *kobj,

			 struct kobj_attribute *attr, char *buff)

{

	return snprintf(buff, PAGE_SIZE, "supported\n");

}



static struct kobj_attribute bugfix_inode_eviction_attr =

	__ATTR_RO(bugfix_inode_eviction);



static ssize_t mounter_context_for_backing_rw_show(struct kobject *kobj,

			  struct kobj_attribute *attr, char *buff)

{
@@ -41,6 +50,7 @@ static struct kobj_attribute mounter_context_for_backing_rw_attr = 


static struct attribute *attributes[] = {

	&corefs_attr.attr,

	&bugfix_inode_eviction_attr.attr,

	&mounter_context_for_backing_rw_attr.attr,

	NULL,

};

fs/incfs/vfs.c

+7 −1
Original line number Diff line number Diff line
@@ -2309,6 +2309,13 @@ void incfs_kill_sb(struct super_block *sb) 


	pr_debug("incfs: unmount\n");



	/*

	 * We must kill the super before freeing mi, since killing the super

	 * triggers inode eviction, which triggers the final update of the

	 * backing file, which uses certain information for mi

	 */

	kill_anon_super(sb);



	if (mi) {

		if (mi->mi_backing_dir_path.dentry)

			dinode = d_inode(mi->mi_backing_dir_path.dentry);
@@ -2320,7 +2327,6 @@ void incfs_kill_sb(struct super_block *sb) 
		incfs_free_mount_info(mi);

		sb->s_fs_info = NULL;

	}

	kill_anon_super(sb);

}



static int show_options(struct seq_file *m, struct dentry *root)