Fix kernel panics caused by thread info flag corruption #2818
+2
−2
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In disable_seccomp(), the line responsible for clearing the TIF_SECCOMP bit from the current task's thread info flags erroneously treats TIF_SECCOMP as a bit mask and clears it in addition to the actual bit mask, _TIF_SECCOMP. TIF_SECCOMP is a bit number, while _TIF_SECCOMP is the bit mask corresponding to that bit number. As a result, this clears multiple unrelated thread info flags in addition to the TIF_SECCOMP flag. On arm64, TIF_SECCOMP is defined as decimal number 11, which translates to 0b1011 in binary. That is the same as BIT(0)|BIT(1)|BIT(3). Since those are the unrelated bits that are cleared, that means the following flags are spuriously cleared on arm64: TIF_SIGPENDING, TIF_NEED_RESCHED, and TIF_FOREIGN_FPSTATE. When TIF_FOREIGN_FPSTATE is spuriously cleared, it means that fpsimd_save() won't be skipped when there is a context switch triggered by involuntary preemption (via interrupt) from within kernel context. And since there is no fpsimd state saved when fpsimd_save() runs in this scenario, there is a NULL pointer dereference kernel panic as a result: [ 33.115229] KernelSU: sys_execve su found [ 33.115636] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 33.115644] Mem abort info: [ 33.115647] ESR = 0x0000000096000046 [ 33.115651] EC = 0x25: DABT (current EL), IL = 32 bits [ 33.115656] SET = 0, FnV = 0 [ 33.115660] EA = 0, S1PTW = 0 [ 33.115664] FSC = 0x06: level 2 translation fault [ 33.115668] Data abort info: [ 33.115671] ISV = 0, ISS = 0x00000046 [ 33.115675] CM = 0, WnR = 1 [ 33.115678] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000b81bf6000 [ 33.115683] [0000000000000000] pgd=0800000b80c50003, p4d=0800000b80c50003, pud=0800000b80c50003, pmd=0000000000000000 [ 33.115697] Internal error: Oops: 0000000096000046 [tiann#1] PREEMPT SMP [ 33.115709] debug-snapshot dss: context saved(CPU:2) [ 33.116002] item - log_kevents is disabled [ 33.116019] CPU: 2 PID: 9119 Comm: androidx.work-2 Tainted: G S W 6.1.156-NeutrinoKernel tiann#1 [ 33.116025] Hardware name: ZUMA PRO COMET MP board based on ZUMA PRO (DT) [ 33.116031] pstate: 224000c5 (nzCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 33.116037] pc : fpsimd_save_state+0x4/0x58 [ 33.116052] lr : fpsimd_save.lto_priv.0+0xe0/0x110 [ 33.116062] sp : ffffff88289f3a10 [ 33.116065] x29: ffffff88289f3a10 x28: ffffff88291ff000 x27: 0000007fd07b29f2 [ 33.116075] x26: ffffff88291ff5a8 x25: 0000000000000000 x24: ffffffd63b8f0000 [ 33.116084] x23: ffffffd63b8f49c8 x22: ffffff800953a598 x21: ffffff8b7fccb340 [ 33.116093] x20: ffffffb5443db000 x19: ffffffd63b8f0340 x18: ffffff8b7fcd7440 [ 33.116102] x17: 0000000000000000 x16: 0000000000000001 x15: ffffffd63bb40000 [ 33.116110] x14: 0000000000000214 x13: 0000000000000203 x12: ffffff8002e4d400 [ 33.116119] x11: 0000000000000000 x10: 0000000000000011 x9 : 00000000000000c0 [ 33.116128] x8 : 0000000000005c45 x7 : 00000000001731c2 x6 : 0000000762585000 [ 33.116137] x5 : 0000000000000000 x4 : 0000000b46387000 x3 : 0000000000000001 [ 33.116145] x2 : 0000000000000000 x1 : 0000000004000000 x0 : 0000000000000000 [ 33.116154] Call trace: [ 33.116158] fpsimd_save_state+0x4/0x58 [ 33.116165] __schedule.lto_priv.0+0x410/0xf40 [ 33.116172] preempt_schedule_irq+0x44/0x80 [ 33.116178] el1_interrupt+0xc4/0x178 [ 33.116186] el1h_64_irq_handler+0x18/0x20 [ 33.116193] el1h_64_irq+0x64/0x68 [ 33.116199] strnlen_user.lto_priv.0+0xe0/0x1a0 [ 33.116209] do_execveat_common+0x1bc/0x24c [ 33.116216] __arm64_sys_execve.lto_priv.0+0xb4/0x1e8 [ 33.116221] invoke_syscall.constprop.0+0x54/0xe0 [ 33.116230] el0_svc+0x228/0x340 [ 33.116237] el0t_64_sync_handler+0x110/0x11c [ 33.116245] el0t_64_sync+0x170/0x174 [ 33.116253] Code: d518212a d5033fdf d53cd051 d503245f (ad000400) [ 33.116257] ---[ end trace 0000000000000000 ]--- Note the `[ 33.115229] KernelSU: sys_execve su found` message immediately preceding the panic. Fix this mayhem by removing TIF_SECCOMP from the bitwise negation for clearing the seccomp flag, since it should only be using _TIF_SECCOMP. Signed-off-by: Sultan Alsawaf <[email protected]>
Thread info flags as well as syscall_work flags must be manipulated atomically. Since disable_seccomp() doesn't atomically clear the seccomp flag, this can result in the loss of an intermediary write into the flag mask in between when the current flag mask is read and then the modified flag mask is written. Losing thread info flag writes can lead to unexpected bugs and kernel panics. Fix this by using the proper helpers to atomically clear the seccomp flag. Signed-off-by: Sultan Alsawaf <[email protected]>
aviraxp
approved these changes
Oct 19, 2025
0ctobot
added a commit
to 0ctobot/neutrino_kernel_google_caimito
that referenced
this pull request
Oct 19, 2025
Signed-off-by: Adam W. Willis <[email protected]>
Owner
|
|
Contributor
Author
|
5.10 absolutely has See: https://elixir.bootlin.com/linux/v5.10/A/ident/clear_thread_flag |
Owner
|
Sorry, I misread that |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.