[backslashxx's KernelSU] Better KSU integration for non-gki devices - #1
Open
ketikai wants to merge 79 commits into
Open
[backslashxx's KernelSU] Better KSU integration for non-gki devices#1ketikai wants to merge 79 commits into
non-gki devices#1ketikai wants to merge 79 commits into
Conversation
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
This refactors original KSU hooks to replace deep kernel function hooks with targeted hooks. This backports KernelSU pr#1657 and having pr#2084 elements (32-bit sucompat). It reduces the scope of kernel function interception and still maintains full fucntionality. This commit is a squash of the following: * fs/exec: do_execve: ksu_handle_execveat hook * fs/exec: compat_do_execve: ksu_handle_execveat_sucompat hook fs/open: sys_faccessat: ksu_handle_faccessat hook * fs/read_write: sys_read: ksu_handle_sys_read hook * fs/stat: sys_newfstatat: ksu_handle_stat hook * fs/stat: sys_fstatat64: ksu_handle_stat hook * drivers: input: input_event: ksu_handle_input_handle_event hook * drivers: tty/pty.c: pts_unix98_lookup: ksu_handle_devpts hook references: KernelSU pr#1657, pr#2084 https://kernelsu.org/guide/how-to-integrate-for-non-gki.html Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
* 添加可选补丁 'policy_rwlock' 。 * 为 'grus_defconfig' 显式配置 'CONFIG_KSU' 子项。 * 为 'grus_defconfig' 显式留空 'CONFIG_LOCALVERSION' 值。 Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
CONFIG_KSU=n Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
ketikai
marked this pull request as draft
June 27, 2026 03:37
ketikai
marked this pull request as ready for review
June 27, 2026 03:38
ketikai
marked this pull request as draft
June 27, 2026 03:38
ketikai
marked this pull request as ready for review
June 27, 2026 03:38
Author
|
@kyasu CR |
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
ketikai
changed the title
non-gki devices for a long time.non-gki devices
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
This reverts commit ef72acc.
This reverts commit be69972.
This reverts commit ea70870.
This reverts commit f45c4f9.
This reverts commit 8f80c99.
This reverts commit fa97668.
This reverts commit be3fe55.
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
…ctor(build-kernel-ksu) feat(build-kernel-ksu-test): 修复、更新、重构和细化与 `ksu` 相关的工作流。 Signed-off-by: ketikai <ketikai@idealstate.team>
…所须的令牌。 Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
… 到 `RELEASE_TAG` 仓库，修复发布仓库未明确的问题。 Signed-off-by: ketikai <ketikai@idealstate.team>
…ase` 下没有写权限的问题，为构建添加 `ccache` 支持。 Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
[ Upstream commit 54da6a0924311c7cf5015533991e44fb8eb12773 ] Use __attribute__((__cleanup__(func))) to build: - simple auto-release pointers using __free() - 'classes' with constructor and destructor semantics for scope-based resource management. - lock guards based on the above classes. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20230612093537.614161713%40infradead.org Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [@acroreiser: port common and spinlock parts of the original patch (backport to 4.9)]
…) based infrastructure"
…er()
remove_waiter() is used by the slowlock paths, but it is also used for
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
futex_requeue().
In the latter case waiter::task is not current, but remove_waiter()
operates on current for the dequeue operation. That results in several
problems:
1) the rbtree dequeue happens without waiter::task::pi_lock being held
2) the waiter task's pi_blocked_on state is not cleared, which leaves a
dangling pointer primed for UAF around.
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
task
Use waiter::task instead of current in all related operations in
remove_waiter() to cure those problems.
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
changelog ]
Fixes: 8161239 ("rtmutex: Simplify PI algorithm and make highest prio task get lock")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
[
@acroreiser: backport to 4.9, switch kernel/locking/rtmutex.c to gnu99 to avoid build error below.
include/linux/cleanup.h:112:9: error: 'for' loop initial declarations are only allowed in C99 or C11 mode
112 | for (CLASS(_name, scope)(args),
]
…aiter() on self-deadlock
When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
waiter->task.
The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
the NULL waiter->task, causing a kernel crash.
Add a self-deadlock check for non-top waiters before calling
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
futex_lock_pi_atomic().
Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
[@acroreiser: backport to 4.9]
…queued
syzbot triggered the following splat in remove_waiter() via
FUTEX_CMP_REQUEUE_PI:
KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]
class_raw_spinlock_constructor
remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561
rt_mutex_start_proxy_lock+0x103/0x120
futex_requeue+0x10e4/0x20d0
__x64_sys_futex+0x34f/0x4d0
task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,
leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead
of current in remove_waiter()") made this fatal.
Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()
upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock
return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()
(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to
account for try_to_take_rt_mutex().
Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()")
Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/
Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net
[@acroreiser: backport to 4.9]
Signed-off-by: ketikai <ketikai@idealstate.team>
Signed-off-by: ketikai <ketikai@idealstate.team>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KernelSU Integration
Backslashxx's KernelSU
How To Setup
Quick Build (Github Actions)
Related