This moves handling of initial SIDs into a separate table. Note that the
SIDs stored in the main table are now shifted by SECINITSID_NUM and
converted to/from the actual SIDs transparently by helper functions.
This change doesn't make much sense on its own, but it simplifies
further sidtab overhaul in a succeeding patch.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: fixed some checkpatch warnings on line length, whitespace]
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 24ed7fdae669feda4c5e0dadba2467c4c0d297d3)
Resolved conflicts with prlimit feature.
Change-Id: If6cebed18fd66777a51c110a0b23e31466b94386
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Ondrej Mosnacekauthored and Sorayukiicommited 2026-05-15 18:06:59 +07:00
This is a purely cosmetic change that encapsulates the three-step sidtab
conversion logic (shutdown -> clone -> map) into a single function
defined in sidtab.c (as opposed to services.c).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: whitespaces fixes to make checkpatch happy]
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 5386e6caa6711407182573e2b0344fe908b0fbcc)
Change-Id: If312a58b359fa77ce4c77b46d79eb76dbb10b7d5
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Ondrej Mosnacekauthored and Sorayukiicommited 2026-05-15 18:06:58 +07:00
Wrap the AVC state within the selinux_state structure and
pass it explicitly to all AVC functions. The AVC private state
is encapsulated in a selinux_avc structure that is referenced
from the selinux_state.
This change should have no effect on SELinux behavior or
APIs (userspace or LSM).
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 6b6bc6205d98796361962ee282a063f18ba8dc57)
Resolved conflicts around non-backported prlimit, sctp, and bprm
features.
Resolved build breakage caused by conflict with backport of
I68ee3dba85c8d64e24f28a0fbc8db2aed3b6f77b
Change-Id: Ib8ae73b9f006e60885545bab6e4e733cd849a264
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Stephen Smalleyauthored and Sorayukiicommited 2026-05-15 18:06:58 +07:00
As reported by yangshukui, a permission denial from security_task_wait()
can lead to a soft lockup in zap_pid_ns_processes() since it only expects
sys_wait4() to return 0 or -ECHILD. Further, security_task_wait() can
in general lead to zombies; in the absence of some way to automatically
reparent a child process upon a denial, the hook is not useful. Remove
the security hook and its implementations in SELinux and Smack. Smack
already removed its check from its hook.
Reported-by: yangshukui <yangshukui@huawei.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 3a2f5a59a695a73e0cde9a61e0feae5fa730e936)
Change-Id: Ie52e96a1158fcb5769a8bdca16fb4d316d4b20dc
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Stephen Smalleyauthored and Sorayukiicommited 2026-05-15 18:06:58 +07:00
Move global selinuxfs state to a per-instance structure (selinux_fs_info),
and include a pointer to the selinux_state in this structure.
Pass this selinux_state to all security server operations, thereby
ensuring that each selinuxfs instance presents a view of and acts
as an interface to a particular selinux_state instance.
This change should have no effect on SELinux behavior or APIs
(userspace or LSM). It merely wraps the selinuxfs global state,
links it to a particular selinux_state (currently always the single
global selinux_state) and uses that state for all operations.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 0619f0f5e36f12e100ef294f5980cfe7c93ff23e)
Resolved some minor conflicts with e.g. the non-backported
lsm notififiers feature.
Change-Id: I9e507223eab040c6aec3bc0a23596e84d7fc8532
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Stephen Smalleyauthored and Sorayukiicommited 2026-05-15 18:06:58 +07:00
Define a selinux state structure (struct selinux_state) for
global SELinux state and pass it explicitly to all security server
functions. The public portion of the structure contains state
that is used throughout the SELinux code, such as the enforcing mode.
The structure also contains a pointer to a selinux_ss structure whose
definition is private to the security server and contains security
server specific state such as the policy database and SID table.
This change should have no effect on SELinux behavior or APIs
(userspace or LSM). It merely wraps SELinux state and passes it
explicitly as needed.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: minor fixups needed due to collisions with the SCTP patches]
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit aa8e712cee93d520e96a2ca8e3a20f807c937e3f)
Resolved conflicts around non-backported support for sctp and ib, as
well as missing cgroup and extended socket class policy capabilities.
Change-Id: I73b28fabb29249278ff9d3890f3a98b7baf74731
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Stephen Smalleyauthored and Sorayukiicommited 2026-05-15 18:06:58 +07:00
During random test as own device to check slub account,
we found some slack memory from hashtab_node(kmalloc-64).
By using kzalloc(), middle of test result like below:
allocated size 240768
request size 45144
slack size 195624
allocation count 3762
So, we want to use kmem_cache_zalloc() and that
can reduce memory size 52byte(slack size/alloc count) per each struct.
Signed-off-by: Kyeongdon Kim <kyeongdon.kim@lge.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 7c620ece125cbab7b5dfcb574ee1e64ab8b562cd)
Change-Id: I23f426ba037842ffb03287846e484a281230902b
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Kyeongdon Kimauthored and Sorayukiicommited 2026-05-15 18:06:57 +07:00
As systemd ramps up enabling NNP (NoNewPrivileges) for system services,
it is increasingly breaking SELinux domain transitions for those services
and their descendants. systemd enables NNP not only for services whose
unit files explicitly specify NoNewPrivileges=yes but also for services
whose unit files specify any of the following options in combination with
running without CAP_SYS_ADMIN (e.g. specifying User= or a
CapabilityBoundingSet= without CAP_SYS_ADMIN): SystemCallFilter=,
SystemCallArchitectures=, RestrictAddressFamilies=, RestrictNamespaces=,
PrivateDevices=, ProtectKernelTunables=, ProtectKernelModules=,
MemoryDenyWriteExecute=, or RestrictRealtime= as per the systemd.exec(5)
man page.
The end result is bad for the security of both SELinux-disabled and
SELinux-enabled systems. Packagers have to turn off these
options in the unit files to preserve SELinux domain transitions. For
users who choose to disable SELinux, this means that they miss out on
at least having the systemd-supported protections. For users who keep
SELinux enabled, they may still be missing out on some protections
because it isn't necessarily guaranteed that the SELinux policy for
that service provides the same protections in all cases.
commit 7b0d0b40cd ("selinux: Permit bounded transitions under
NO_NEW_PRIVS or NOSUID.") allowed bounded transitions under NNP in
order to support limited usage for sandboxing programs. However,
defining typebounds for all of the affected service domains
is impractical to implement in policy, since typebounds requires us
to ensure that each domain is allowed everything all of its descendant
domains are allowed, and this has to be repeated for the entire chain
of domain transitions. There is no way to clone all allow rules from
descendants to their ancestors in policy currently, and doing so would
be undesirable even if it were practical, as it requires leaking
permissions to objects and operations into ancestor domains that could
weaken their own security in order to allow them to the descendants
(e.g. if a descendant requires execmem permission, then so do all of
its ancestors; if a descendant requires execute permission to a file,
then so do all of its ancestors; if a descendant requires read to a
symbolic link or temporary file, then so do all of its ancestors...).
SELinux domains are intentionally not hierarchical / bounded in this
manner normally, and making them so would undermine their protections
and least privilege.
We have long had a similar tension with SELinux transitions and nosuid
mounts, albeit not as severe. Users often have had to choose between
retaining nosuid on a mount and allowing SELinux domain transitions on
files within those mounts. This likewise leads to unfortunate tradeoffs
in security.
Decouple NNP/nosuid from SELinux transitions, so that we don't have to
make a choice between them. Introduce a nnp_nosuid_transition policy
capability that enables transitions under NNP/nosuid to be based on
a permission (nnp_transition for NNP; nosuid_transition for nosuid)
between the old and new contexts in addition to the current support
for bounded transitions. Domain transitions can then be allowed in
policy without requiring the parent to be a strict superset of all of
its children.
With this change, systemd unit files can be left unmodified from upstream.
SELinux-disabled and SELinux-enabled users will benefit from retaining any
of the systemd-provided protections. SELinux policy will only need to
be adapted to enable the new policy capability and to allow the
new permissions between domain pairs as appropriate.
NB: Allowing nnp_transition between two contexts opens up the potential
for the old context to subvert the new context by installing seccomp
filters before the execve. Allowing nosuid_transition between two contexts
opens up the potential for a context transition to occur on a file from
an untrusted filesystem (e.g. removable media or remote filesystem). Use
with care.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit af63f4193f9fbbbac50fc766417d74735afd87ef)
Resolved conflicts with extended_socket_class and cgroup_seclabel
policy capabilities. These are referred to as "compat1" and "compat2"
in the change to preserve compatibility with the policy binary.
Neither of these policy capabilities are appropriate for backporting
as they will break Treble backwards-compat requirements.
Change-Id: Ib929be4e477e20ce18e1ef23e66cd0ed8d4fe99b
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Stephen Smalleyauthored and Sorayukiicommited 2026-05-15 18:06:57 +07:00
Log the state of SELinux policy capabilities when a policy is loaded.
For each policy capability known to the kernel, log the policy capability
name and the value set in the policy. For policy capabilities that are
set in the loaded policy but unknown to the kernel, log the policy
capability index, since this is the only information presently available
in the policy.
Sample output with a policy created with a new capability defined
that is not known to the kernel:
SELinux: policy capability network_peer_controls=1
SELinux: policy capability open_perms=1
SELinux: policy capability extended_socket_class=1
SELinux: policy capability always_check_network=0
SELinux: policy capability cgroup_seclabel=0
SELinux: unknown policy capability 5
Resolves: https://github.com/SELinuxProject/selinux-kernel/issues/32
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 4dc2fce342f8e5b165e2eda29a39446bb07b2457)
Resolved conflicts with extended_socket_class and cgroup_seclabel
policy capabilities. These are referred to as "compat1" and "compat2"
in the change to preserve compatibility with the policy binary.
Neither of these policy capabilities are appropriate for backporting
as they will break Treble backwards-compat requirements.
Change-Id: Ic1c37514b742829904e3c9536a865f29150658ce
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Stephen Smalleyauthored and Sorayukiicommited 2026-05-15 18:06:57 +07:00
This commit causing a page handling failure if the kernel
compiled with LLD, and as the commit message says, this is
just a temporary Android-only patch that will deprecated in
newer kernel, new fix will be backported after it arrives
on upstream (or if Google backported that before I do)
This reverts commit 2c434f622e.
Bug: SELinux Breaks in LLD
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Rapherion Rollerscaperersauthored and Sorayukiicommited 2026-05-15 18:06:57 +07:00
Some of the changes in this commit are no longer suitable as we
have selinux backports from upstream kernel. Revert it first so
relevant fixes can be ported later.
This reverts commit 90da9cd13d.
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Chenyang Zhongauthored and Sorayukiicommited 2026-05-15 18:06:57 +07:00
The script "checkpatch.pl" pointed information out like the following.
Comparison to NULL could be written !…
Thus fix affected source code places.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit cb8d21e3640f18444c597bddaec156637eacecf8)
Change-Id: Ide6997370b5db4f35fafb84330f7f9bab3e388ad
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Markus Elfringauthored and Sorayukiicommited 2026-05-15 18:06:57 +07:00
A multiplication for the size determination of a memory allocation
indicated that an array data structure should be processed.
Thus use the corresponding function "kmalloc_array".
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 2f00e680fe25d8d2758879b772d54cb46a78b59d)
Change-Id: I8bbc5d3698e4eee8c4af4a050c32ce5a2dde7cee
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Markus Elfringauthored and Sorayukiicommited 2026-05-15 18:06:57 +07:00
The allocated size for each ebitmap_node is 192byte by kzalloc().
Then, ebitmap_node size is fixed, so it's possible to use only 144byte
for each object by kmem_cache_zalloc().
It can reduce some dynamic allocation size.
Signed-off-by: Junil Lee <junil0814.lee@lge.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit b4958c892e02241b9bd121f3397b76225ff6f4a3)
Change-Id: I68b546651051e76907992e18b20fe798aa32eff3
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Junil Leeauthored and Sorayukiicommited 2026-05-15 18:06:56 +07:00
commit 86c8db86af43f52f682e53a0f2f0828683be1e52 upstream.
We should count the terminating NUL byte as part of the ctx_len.
Otherwise, UBSAN logs a warning:
UBSAN: array-index-out-of-bounds in security/selinux/xfrm.c:99:14
index 60 is out of range for type 'char [*]'
The allocation itself is correct so there is no actual out of bounds
indexing, just a warning.
Cc: stable@vger.kernel.org
Suggested-by: Christian Göttsche <cgzones@googlemail.com>
Link: https://lore.kernel.org/selinux/CAEjxPJ6tA5+LxsGfOJokzdPeRomBHjKLBVR6zbrg+_w3ZZbM3A@mail.gmail.com/
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Stephen Smalleyauthored and Sorayukiicommited 2026-05-15 18:06:56 +07:00
commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 upstream.
When evaluating extended permissions, ignore unknown permissions instead
of calling BUG(). This commit ensures that future permissions can be
added without interfering with older kernels.
Cc: stable@vger.kernel.org
Fixes: fa1aa143ac ("selinux: extended permissions for ioctls")
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Thiébaud Weksteenauthored and Sorayukiicommited 2026-05-15 18:06:56 +07:00
commit 42c4e97e06a839b07d834f640a10911ad84ec8b3 upstream.
The Linux Kernel currently only requires make v3.82 while the grouped
target functionality requires make v4.3. Removed the grouped target
introduced in 4ce1f694eb5d ("selinux: ensure av_permissions.h is
built when needed") as well as the multiple header file targets in
the make rule. This effectively reverts the problem commit.
We will revisit this change when make >= 4.3 is required by the rest
of the kernel.
Cc: stable@vger.kernel.org
Fixes: 4ce1f694eb5d ("selinux: ensure av_permissions.h is built when needed")
Reported-by: Erwan Velu <e.velu@criteo.com>
Reported-by: Luiz Capitulino <luizcap@amazon.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Paul Mooreauthored and Sorayukiicommited 2026-05-15 18:06:56 +07:00
[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ]
The Makefile rule responsible for building flask.h and
av_permissions.h only lists flask.h as a target which means that
av_permissions.h is only generated when flask.h needs to be
generated. This patch fixes this by adding av_permissions.h as a
target to the rule.
Fixes: 8753f6bec3 ("selinux: generate flask headers during kernel build")
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli+cip@fpond.eu>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Paul Mooreauthored and Sorayukiicommited 2026-05-15 18:06:56 +07:00
[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ]
Make the flask.h target depend on the genheaders binary instead of
classmap.h to ensure that it is rebuilt if any of the dependencies of
genheaders are changed.
Notably this fixes flask.h not being rebuilt when
initial_sid_to_string.h is modified.
Fixes: 8753f6bec3 ("selinux: generate flask headers during kernel build")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli+cip@fpond.eu>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Ondrej Mosnacekauthored and Sorayukiicommited 2026-05-15 18:06:56 +07:00
This patch allows genfscon per-file labeling for cgroupfs. For instance,
this allows to label the "release_agent" file within each
cgroup mount and limit writes to it.
Signed-off-by: Antonio Murdaca <amurdaca@redhat.com>
[PM: subject line and merge tweaks]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Antonio Murdacaauthored and Sorayukiicommited 2026-05-15 18:06:55 +07:00
This patch allows genfscon per-file labeling for binderfs.
This is required to have separate permissions to allow
access to binder, hwbinder and vndbinder devices which are
relocating to binderfs.
Acked-by: Jeff Vander Stoep <jeffv@google.com>
Acked-by: Mark Salyzyn <salyzyn@android.com>
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Hridya Valsarajuauthored and Sorayukiicommited 2026-05-15 18:06:55 +07:00
With a 64-bit kernel build the FUSE device cannot handle ioctl requests
coming from 32-bit user space.
This is due to the ioctl command translation that generates different
command identifiers that thus cannot be used for direct comparisons
without proper manipulation.
Explicitly extract type and number from the ioctl command to enable
32-bit user space compatibility on 64-bit kernel builds.
Bug: 179164095
Link: https://lore.kernel.org/lkml/20210125153057.3623715-3-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I595517c54d551be70e83c7fcb4b62397a3615004
Signed-off-by: Alessio Balsini <balsini@google.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Alessio Balsiniauthored and Sorayukiicommited 2026-05-15 18:06:55 +07:00
In function parameters, `u32 data[]` decays to `u32 *`, making
the array syntax misleading and triggering
-Wsizeof-array-argument warnings.
Replace the array-style parameter with an explicit pointer type
to match the actual semantics and silence the warning.
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
From Android 16 CDD:
[C-0-13] MUST implement the shell command dumpsys gpu --gpuwork to
display the aggregated GPU work data returned by the
power/gpu_work_period kernel tracepoint, or display no data if the
tracepoint is not supported. The AOSP implementation is
frameworks/native/services/gpuservice/gpuwork/.
Bug: 457797217
Test: cat /sys/kernel/tracing/events/power/gpu_work_period/format
Change-Id: Ia3d695d4297d8e2d6b4ad89e5747e39aec737810
Signed-off-by: Chia-I Wu <olv@google.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Chia-I Wuauthored and Sorayukiicommited 2026-05-15 18:04:22 +07:00
From Android 16 CDD:
[7.1.4.6/H-1-4] MUST report a GPU Frequency tracepoint as specified by
the format: power/gpu_frequency.
Bug: 457797217
Test: cat /sys/kernel/tracing/events/power/gpu_frequency/format
Change-Id: Ie8cd95cb8fe8471c2de19c48cdf57c8cf59f2370
Signed-off-by: Chia-I Wu <olv@google.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Chia-I Wuauthored and Sorayukiicommited 2026-05-15 18:04:22 +07:00
Move the source to a better place in Device Drivers -> Graphics support
now that its configurable.
v4:
- Move source location (Tvrtko)
v3:
- Patch introduced to replace per-driver config (Lucas)
Change-Id: I50da95e8b65029ddfa525b83a182e7bc54693a13
Signed-off-by: Juston Li <justonli@chromium.org>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://lore.kernel.org/r/20250611225145.1739201-1-justonli@chromium.org
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Juston Liauthored and Sorayukiicommited 2026-05-15 18:04:22 +07:00
This change adds the below gpu memory tracepoint:
gpu_mem/gpu_mem_total: track global or proc gpu memory total usages
Per process tracking of total gpu memory usage in the gem layer is not
appropriate and hard to implement with trivial overhead. So for the gfx
device driver layer to track total gpu memory usage both globally and
per process in an easy and uniform way is to integrate the tracepoint in
this patch to the underlying varied implementations of gpu memory
tracking system from vendors.
Putting this tracepoint in the common trace events can not only help
wean the gfx drivers off of debugfs but also greatly help the downstream
Android gpu vendors because debugfs is to be deprecated in the upcoming
Android release. Then the gpu memory tracking of both Android kernel and
the upstream linux kernel can stay closely, which can benefit the whole
kernel eco-system in the long term.
Link: http://lkml.kernel.org/r/20200302235044.59163-1-zzyiwei@google.com
Bug: 154523335
Test: saw this tracepoint on Pixel after gfx driver integration
Change-Id: Ia6f273015c656e7a286041d850e83e49fd063aa4
(cherry picked from commit bbd9d05618a6d608c72640b1d3d651a75913456a)
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Yiwei Zhang <zzyiwei@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Yiwei Zhangauthored and Sorayukiicommited 2026-05-15 18:04:21 +07:00
Android uses ashmem for sharing memory regions. We are looking forward
to migrating all usecases of ashmem to memfd so that we can possibly
remove the ashmem driver in the future from staging while also
benefiting from using memfd and contributing to it. Note staging drivers
are also not ABI and generally can be removed at anytime.
One of the main usecases Android has is the ability to create a region
and mmap it as writeable, then add protection against making any
"future" writes while keeping the existing already mmap'ed
writeable-region active. This allows us to implement a usecase where
receivers of the shared memory buffer can get a read-only view, while
the sender continues to write to the buffer.
See CursorWindow documentation in Android for more details:
https://developer.android.com/reference/android/database/CursorWindow
This usecase cannot be implemented with the existing F_SEAL_WRITE seal.
To support the usecase, this patch adds a new F_SEAL_FUTURE_WRITE seal
which prevents any future mmap and write syscalls from succeeding while
keeping the existing mmap active.
Verified with test program at: https://lore.kernel.org/patchwork/patch/1008117/
Backport link: https://lore.kernel.org/patchwork/patch/1014892/
Bug: 113362644
Change-Id: If7424db3b64372932d455f0219cd9df613fec1d4
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Joel Fernandes <joelaf@google.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Joel Fernandesauthored and Sorayukiicommited 2026-05-15 18:04:21 +07:00
Being interrupted by a signal during binder ioctls is not unusual.
Commit 218225c05beaf02320f05a9b3b7041e27a0684f7 changed the interrupted
ioctl return code from ERESTARTSYS to EINTR, but the error logging check
was never updated:
[ 352.090265] binder: 6534:6552 ioctl c0306201 7a0f9fea10 returned -4
[ 352.090393] binder: 6534:7670 ioctl c0306201 7a6489da10 returned -4
[ 352.090432] binder: 6534:9501 ioctl c0306201 7a61377a10 returned -4
Update the return code to fix the log spam.
[orges]: this is not actually a duplicate commit. the log is pretty much
the same except it returns -512
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
Signed-off-by: Oktapra Amtono <oktapra.amtono@gmail.com>
Signed-off-by: Forenche <prahul2003@gmail.com>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Danny Linauthored and Sorayukiicommited 2026-05-15 18:04:21 +07:00
In binder, using GFP_HIGHMEM will result in the allocated memory
not to be mapped in the kernel's virtual address space.
This prevents the kernel from being capable of directly
referring it.
Change-Id: I952dbc8ae205e47fa00ddf186ef306903f623367
Signed-off-by: Panchajanya1999 <panchajanya@azure-dev.live>
Signed-off-by: Forenche <prahul2003@gmail.com>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Panchajanya1999authored and Sorayukiicommited 2026-05-15 18:04:20 +07:00
Most of binder's memory allocations are tiny, and they're allocated
and freed extremely frequently. The latency from going through the page
allocator all the time for such small allocations ends up being quite
high, especially when the system is low on memory. Binder is
performance-critical, so this is suboptimal.
Instead of using kzalloc to allocate a struct every time, reserve caches
specifically for allocating each struct quickly.
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Sultan Alsawafauthored and Sorayukiicommited 2026-05-15 18:04:20 +07:00
Binder code is very hot, so checking frequently to see if a debug
message should be printed is a waste of cycles. We're not debugging
binder, so just stub out the debug prints to compile them out entirely.
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Sultan Alsawafauthored and Sorayukiicommited 2026-05-15 18:04:20 +07:00
Provide userspace with a mechanism to discover features supported by
the binder driver to refrain from using any unsupported ones in the
first place. Starting with "oneway_spam_detection" only new features
are to be listed under binderfs and all previous ones are assumed to
be supported.
Assuming an instance of binderfs has been mounted at /dev/binderfs,
binder feature files can be found under /dev/binderfs/features/.
Usage example:
$ mkdir /dev/binderfs
$ mount -t binder binder /dev/binderfs
$ cat /dev/binderfs/features/oneway_spam_detection
1
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20210715031805.1725878-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Carlos Llamasauthored and Sorayukiicommited 2026-05-15 18:04:20 +07:00
The pointer n is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200910151221.751464-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Colin Ian Kingauthored and Sorayukiicommited 2026-05-15 18:04:20 +07:00
The function close_fd_get_file is explicitly a variant of
__close_fd[1]. Now that __close_fd has been renamed close_fd, rename
close_fd_get_file to be consistent with close_fd.
When __alloc_fd, __close_fd and __fd_install were introduced the
double underscore indicated that the function took a struct
files_struct parameter. The function __close_fd_get_file never has so
the naming has always been inconsistent. This just cleans things up
so there are not any lingering mentions or references __close_fd left
in the code.
[1] 80cd795630d6 ("binder: fix use-after-free due to ksys_close() during fdget()")
Link: https://lkml.kernel.org/r/20201120231441.29911-23-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Eric W. Biedermanauthored and Sorayukiicommited 2026-05-15 18:04:20 +07:00
Since the original trace_binder_transaction_received cannot
precisely present the real finished time of transaction, adding a
trace_binder_txn_latency_free at the point of free transaction
may be more close to it.
Signed-off-by: Frankie.Chang <Frankie.Chang@mediatek.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/1605063764-12930-3-git-send-email-Frankie.Chang@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Frankie.Changauthored and Sorayukiicommited 2026-05-15 18:04:19 +07:00
Commit e00eb41c0c7b ("ANDROID: binder: add support for RT prio
inheritance.") added the use of MAX_USER_RT_PRIO to the binder.c code,
but that commit was never sent upstream.
In commit ae18ad281e82 ("sched: Remove MAX_USER_RT_PRIO"), that define
was taken away, so to fix up the build breakage, move the binder code to
use MAX_RT_PRIO instead of the now-removed MAX_USER_RT_PRIO define.
Hopefully this is correct, who knows, it's binder RT code! :)
Bug: 34461621
Bug: 37293077
Bug: 120446518
Fixes: e00eb41c0c7b ("ANDROID: binder: add support for RT prio inheritance.")
Fixes: ae18ad281e82 ("sched: Remove MAX_USER_RT_PRIO")
Cc: Martijn Coenen <maco@google.com>
Cc: Amit Pundir <amit.pundir@linaro.org>
Cc: Alistair Strachan <astrachan@google.com>
Cc: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I66b85e99697fdde462ec2d2ade5c92d5917896a3
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Greg Kroah-Hartmanauthored and Sorayukiicommited 2026-05-15 18:04:19 +07:00
In the case of a failed transaction, only the thread and process id are
logged. Add the handle info for the reference to the target node in user
error log to aid debugging.
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Ramji Jiyani <ramjiyani@google.com>
Link: https://lore.kernel.org/r/20210802220446.1938347-1-ramjiyani@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Ramji Jiyaniauthored and Sorayukiicommited 2026-05-15 18:04:19 +07:00
Depending on the context, the error return value
here (extra_buffers_size < added_size) should be
negative.
Acked-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201026110314.135481-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Zhang Qilongauthored and Sorayukiicommited 2026-05-15 18:04:19 +07:00
This was a "temporary" reversion to workaround what is believed to be a user-space issue.
Change-Id: I5322aecfe57cd8237e6657525eb33975c4840059
Bug: 166779391
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Jebaitedneko <Jebaitedneko@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Todd Kjosauthored and Sorayukiicommited 2026-05-15 18:04:19 +07:00
Ondrej Mosnacek
authored and
Sorayukii
commited 
Alexey Dobriyan
authored and
Stephen Smalley
authored and
Paul Moore
authored and
Kyeongdon Kim
authored and
Rapherion Rollerscaperers
authored and
Chenyang Zhong
authored and
Markus Elfring
authored and
Junil Lee
authored and
Stephen Smalley
authored and
Thiébaud Weksteen
authored and
Antonio Murdaca
authored and
Hridya Valsaraju
authored and
Alessio Balsini
authored and
Chia-I Wu
authored and
Juston Li
authored and
Yiwei Zhang
authored and
Joel Fernandes
authored and
Danny Lin
authored and
ExactExampl
authored and
zeelog
authored and
Panchajanya1999
authored and
Sultan Alsawaf
authored and
Tang Bin
authored and
Carlos Llamas
authored and
Colin Ian King
authored and
Eric W. Biederman
authored and
Frankie.Chang
authored and
Greg Kroah-Hartman
authored and
Liu Shixin
authored and
Ramji Jiyani
authored and
Zhang Qilong
authored and
Todd Kjos
authored and