| Message ID | 20240719204701.1605950-1-minipli@grsecurity.net (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | tracing: user events UAF crash report | expand |
On Fri, Jul 19, 2024 at 10:47:01PM +0200, Mathias Krause wrote: > Hi Steven, Ajay, > > [ @Cc list: I found out issues with tracefs have been reported / > attempted to get fixed in the past, so you may be interested. ] > > I noticed, the user events ftrace selftest is crashing every now and > then in our automated tests. Digging into, I found that the following > is triggering the issue very reliable: > > - in one shell, as root: > # while true; do ./kselftest/user_events/ftrace_test; done > > - in a second shell, again as root: > # cd /sys/kernel/tracing > # while true; do cat events/user_events/__test_event/format; done 2>/dev/null > > Ignoring that the selftest fails for half of its tests -- which is a > regression and therefore yet another bug, I guess -- this triggers an > access fault (GFP/PF/NULL deref) after a few iterations, usually within > a minute, mostly mere seconds. With KASAN enabled it generates a splat > almost instantly, like following: > > [ 23.790955] ================================================================== > [ 23.791692] BUG: KASAN: slab-use-after-free in f_show+0x43b/0x470 > [ 23.792244] Read of size 8 at addr ffff888007076878 by task cat/755 > [ 23.792753] > [ 23.792947] CPU: 1 PID: 755 Comm: cat Tainted: G D N 6.10.0-vanilla-dirty #30 > [ 23.793563] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 > [ 23.794280] Call Trace: > [ 23.794470] <TASK> > [ 23.794642] dump_stack_lvl+0x66/0xa0 > [ 23.794909] print_report+0xd0/0x630 > [ 23.795180] ? f_show+0x43b/0x470 > [ 23.795415] ? __virt_addr_valid+0x208/0x3f0 > [ 23.795700] ? f_show+0x43b/0x470 > [ 23.795935] kasan_report+0xd8/0x110 > [ 23.796183] ? f_show+0x43b/0x470 > [ 23.796418] f_show+0x43b/0x470 > [ 23.796645] seq_read_iter+0x418/0x11e0 > [ 23.796907] ? __page_table_check_ptes_set+0x166/0x1a0 > [ 23.797280] seq_read+0x261/0x350 > [ 23.797537] ? lock_release+0x453/0x600 > [ 23.797819] ? __pfx_seq_read+0x10/0x10 > [ 23.798103] ? set_ptes.isra.0+0x11b/0x150 > [ 23.798402] vfs_read+0x171/0x9e0 > [ 23.798657] ? lock_acquire+0x408/0x4b0 > [ 23.798970] ? __pfx_vfs_read+0x10/0x10 > [ 23.799267] ? lock_release+0x453/0x600 > [ 23.799549] ? do_user_addr_fault+0x45b/0x8b0 > [ 23.799862] ? __pfx_lock_release+0x10/0x10 > [ 23.800162] ? __pfx___up_read+0x10/0x10 > [ 23.800448] ksys_read+0xdd/0x1a0 > [ 23.800704] ? __pfx_ksys_read+0x10/0x10 > [ 23.801007] ? do_user_addr_fault+0x465/0x8b0 > [ 23.801341] do_syscall_64+0x66/0x130 > [ 23.801615] entry_SYSCALL_64_after_hwframe+0x71/0x79 > [ 23.801959] RIP: 0033:0x7f1fdb9df40e > [ 23.802230] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 > [ 23.803352] RSP: 002b:00007fff86d62658 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 > [ 23.803848] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f1fdb9df40e > [ 23.804302] RDX: 0000000000020000 RSI: 00007f1fdb8d3000 RDI: 0000000000000003 > [ 23.804753] RBP: 00007f1fdb8d3000 R08: 00007f1fdb8d2010 R09: 0000000000000000 > [ 23.805239] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000 > [ 23.805694] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 > [ 23.806153] </TASK> > [ 23.806352] > [ 23.806518] Allocated by task 753: > [ 23.806781] kasan_save_stack+0x20/0x40 > [ 23.807094] kasan_save_track+0x14/0x30 > [ 23.807377] __kasan_kmalloc+0x8f/0xa0 > [ 23.807656] user_event_parse_cmd+0x590/0x25e0 > [ 23.807969] user_events_ioctl+0xa52/0x17f0 > [ 23.808267] __x64_sys_ioctl+0x133/0x190 > [ 23.808555] do_syscall_64+0x66/0x130 > [ 23.808830] entry_SYSCALL_64_after_hwframe+0x71/0x79 > [ 23.809208] > [ 23.809370] Freed by task 58: > [ 23.809609] kasan_save_stack+0x20/0x40 > [ 23.809890] kasan_save_track+0x14/0x30 > [ 23.810173] kasan_save_free_info+0x3b/0x60 > [ 23.810473] poison_slab_object+0x10a/0x170 > [ 23.810771] __kasan_slab_free+0x14/0x30 > [ 23.811090] kfree+0xe0/0x2f0 > [ 23.811338] destroy_user_event+0x305/0x450 > [ 23.811639] delayed_destroy_user_event+0x5c/0xe0 > [ 23.811965] process_one_work+0x81c/0x1970 > [ 23.812259] worker_thread+0x608/0x1160 > [ 23.812542] kthread+0x2be/0x3b0 > [ 23.812794] ret_from_fork+0x2c/0x70 > [ 23.813098] ret_from_fork_asm+0x1a/0x30 > [ 23.813387] > [ 23.813551] Last potentially related work creation: > [ 23.813885] kasan_save_stack+0x20/0x40 > [ 23.814168] __kasan_record_aux_stack+0x8e/0xa0 > [ 23.814489] insert_work+0x20/0x1b0 > [ 23.814756] __queue_work+0x67a/0xc60 > [ 23.815079] queue_work_on+0x63/0x90 > [ 23.815350] user_event_put+0x1f9/0x390 > [ 23.815631] user_events_ioctl+0x11ed/0x17f0 > [ 23.815935] __x64_sys_ioctl+0x133/0x190 > [ 23.816223] do_syscall_64+0x66/0x130 > [ 23.816498] entry_SYSCALL_64_after_hwframe+0x71/0x79 > [ 23.816841] > [ 23.817019] The buggy address belongs to the object at ffff888007076800 > [ 23.817019] which belongs to the cache kmalloc-cg-512 of size 512 > [ 23.817799] The buggy address is located 120 bytes inside of > [ 23.817799] freed 512-byte region [ffff888007076800, ffff888007076a00) > [ 23.818530] > [ 23.818694] The buggy address belongs to the physical page: > [ 23.819092] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7074 > [ 23.819602] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 > [ 23.820323] memcg:ffff88800277fd01 > [ 23.820595] anon flags: 0x40(head|zone=0) > [ 23.820885] page_type: 0xffffefff(slab) > [ 23.821203] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 0000000000000001 > [ 23.821706] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff88800277fd01 > [ 23.822206] head: 0000000000000040 ffff88800014cdc0 0000000000000000 0000000000000001 > [ 23.822711] head: 0000000000000000 0000000080100010 00000001ffffefff ffff88800277fd01 > [ 23.823261] head: 0000000000000002 ffffea00001c1d01 ffffffffffffffff 0000000000000000 > [ 23.823764] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000 > [ 23.824271] page dumped because: kasan: bad access detected > [ 23.824638] > [ 23.824799] Memory state around the buggy address: > [ 23.825162] ffff888007076700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > [ 23.825641] ffff888007076780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > [ 23.826116] >ffff888007076800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 23.826588] ^ > [ 23.827070] ffff888007076880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 23.827545] ffff888007076900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 23.828018] ================================================================== > > I did a bisect run and ended up on commit 27152bceea1d ("eventfs: Move > tracing/events to eventfs"). This is, of cause, only the enabling > commit. The bug is likely in one of the preceeding commits introducing > eventfs infrastructure. > > The git bisect log (I jumped around a little in the beginning, but yeah, > v6.10 is still broken): > > git bisect start > # status: waiting for both good and bad commits > # bad: [a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6] Linux 6.9 > git bisect bad a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 > # status: waiting for good commit(s), bad commit known > # bad: [0c3836482481200ead7b416ca80c68a29cfdaabd] Linux 6.10 > git bisect bad 0c3836482481200ead7b416ca80c68a29cfdaabd > # status: waiting for good commit(s), bad commit known > # bad: [ffc253263a1375a65fa6c9f62a893e9767fbebfa] Linux 6.6 > git bisect bad ffc253263a1375a65fa6c9f62a893e9767fbebfa > # status: waiting for good commit(s), bad commit known > # good: [6995e2de6891c724bfeb2db33d7b87775f913ad1] Linux 6.4 > git bisect good 6995e2de6891c724bfeb2db33d7b87775f913ad1 > # good: [692f5510159c79bfa312a4e27a15e266232bfb4c] Merge tag 'asoc-v6.6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus > git bisect good 692f5510159c79bfa312a4e27a15e266232bfb4c > # good: [0e72db77672ff4758a31fb5259c754a7bb229751] Merge tag 'soc-dt-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc > git bisect good 0e72db77672ff4758a31fb5259c754a7bb229751 > # bad: [5eea5820c7340d39e56e169e1b87199391105f6b] Merge tag 'mm-stable-2023-09-04-14-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > git bisect bad 5eea5820c7340d39e56e169e1b87199391105f6b > # good: [28a4f91f5f251689c69155bc6a0b1afc9916c874] Merge tag 'driver-core-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core > git bisect good 28a4f91f5f251689c69155bc6a0b1afc9916c874 > # bad: [f7e97ce26972ae7be8bbbae8d819ff311d4c5900] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma > git bisect bad f7e97ce26972ae7be8bbbae8d819ff311d4c5900 > # good: [9a5d660fdb25d20748d7f9e9559c86073c3bb368] media: ivsc: Add ACPI dependency > git bisect good 9a5d660fdb25d20748d7f9e9559c86073c3bb368 > # good: [704e2c6107f1a5353a1038bac137dda0df2a6dd0] Merge tag 'icc-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next > git bisect good 704e2c6107f1a5353a1038bac137dda0df2a6dd0 > # good: [bd30fe6a7d9b72e73c5ac9109cbc3066dde08034] Merge tag 'wq-for-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq > git bisect good bd30fe6a7d9b72e73c5ac9109cbc3066dde08034 > # good: [d952f54d01ec2ea5ee9d5e21f2ea3a5807b4bcbc] RDMA/hns: Remove unused declaration hns_roce_modify_srq() > git bisect good d952f54d01ec2ea5ee9d5e21f2ea3a5807b4bcbc > # bad: [34232fcfe9a383bea802af682baae5c99f22376c] Merge tag 'trace-v6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace > git bisect bad 34232fcfe9a383bea802af682baae5c99f22376c > # bad: [7c1130ea5cae215588e6d51242b877fd405e6c32] test: ftrace: Fix kprobe test for eventfs > git bisect bad 7c1130ea5cae215588e6d51242b877fd405e6c32 > # good: [5bdcd5f5331a276a3ddf1fba8605986d0d15298a] eventfs: Implement removal of meta data from eventfs > git bisect good 5bdcd5f5331a276a3ddf1fba8605986d0d15298a > # bad: [27152bceea1df27ffebb12ac9cd9adbf2c4c3f35] eventfs: Move tracing/events to eventfs > git bisect bad 27152bceea1df27ffebb12ac9cd9adbf2c4c3f35 > # first bad commit: [27152bceea1df27ffebb12ac9cd9adbf2c4c3f35] eventfs: Move tracing/events to eventfs > > I stared quite hard at the inode/dentry/file handling and, imho, it's > quite broken as it leaks pointers to refcounted objects which may go > away anytime, e.g. &user->call via trace_add_event_call() in > user_event_set_call_visible(). That'll lead to a user reachable file > hierarchy below events/user_events/$eventname/ that isn't bound to the > creator's mm. > > Assume one process opens events/user_events/$eventname/format, then the > walked fields -- the whole object, actually -- may go away anytime, once > the creator either removes the user probe again or closes its fd to > /sys/kernel/tracing/user_events_data, leading to user_events_release() > doing the final user_event_put() leading to object destruction. The > concurrent reader of events/user_events/$eventname/format will now > operate on a free'd object. Boom! > > As mentioned, I stared quite hard at the code and tried to fix it via > numerous ways but the core issue is, imho, the lack of refcounting the > &user->call object, or even better, 'user', for the files created below > events/user_events/$eventname/. However, I found no easy way to do that. > > My hopes are, you may be able to, now that there's an easy reproducer. > > Beside the obvious bug, I noticed the following (not fixing the issue, > tho): > > diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c > index 5d88c184f0fc..687ad0a26458 100644 > --- a/fs/tracefs/event_inode.c > +++ b/fs/tracefs/event_inode.c > @@ -112,7 +112,7 @@ static void release_ei(struct kref *ref) > entry->release(entry->name, ei->data); > } > > - call_rcu(&ei->rcu, free_ei_rcu); > + call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu); > } > > static inline void put_ei(struct eventfs_inode *ei) > @@ -735,7 +735,9 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode > > /* Was the parent freed? */ > if (list_empty(&ei->list)) { > + mutex_lock(&eventfs_mutex); > cleanup_ei(ei); > + mutex_unlock(&eventfs_mutex); > ei = NULL; > } > return ei; > > The s/call_rcu/call_srcu/ one is because not only do the comments talk > about SRCU protection, the code does so as well, e.g. eventfs_iterate(). > > Similar argumentation for taking the mutex around cleanup_ei(). It sets > the 'is_freed' member which others expect only to be set -- or at least > to have a stable value -- when the mutex is hold. As 'ei' was exposed to > its parent before, it may have escaped to other users, e.g. via > eventfs_iterate(). > > I may have missed something, painting these changes completely void, > therefore spared me the time to do proper patches. However, below one is > legit ("git am --scissors ..." yada yada): > > ---8<--- > Subject: [PATCH] eventfs: Don't return NULL in eventfs_create_dir() > > Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing > ei->dentry") added another check, testing if the parent was freed after > we released the mutex. If so, the function returns NULL. However, all > callers expect it to either return a valid pointer or an error pointer, > at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug > in event_subsystem_dir()"). Returning NULL will therefore fail the error > condition check in the caller. > > Fix this by substituting the NULL return value with a fitting error > pointer. > > Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") > Cc: Dan Carpenter <dan.carpenter@linaro.org> > Signed-off-by: Mathias Krause <minipli@grsecurity.net> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Yeah. It's unfortunate how the timing worked where we merged conflicting patches at basically the same time. In an ideal would we would have found this bug through static analysis but the callers don't dereference "ei" so we can't tell if it's intentional or not. This bug seems like it would be annoying to hit but I'm not sure how if it would lead to a crash. Anyway, thanks for the patch. I hope Steven is able to fix the more complicated bug. regards, dan carpenter
On Sat, Jul 20, 2024 at 2:17 AM Mathias Krause <minipli@grsecurity.net> wrote: > > Hi Steven, Ajay, > > [ @Cc list: I found out issues with tracefs have been reported / > attempted to get fixed in the past, so you may be interested. ] > > I noticed, the user events ftrace selftest is crashing every now and > then in our automated tests. Digging into, I found that the following > is triggering the issue very reliable: > > - in one shell, as root: > # while true; do ./kselftest/user_events/ftrace_test; done > > - in a second shell, again as root: > # cd /sys/kernel/tracing > # while true; do cat events/user_events/__test_event/format; done 2>/dev/null > Tried to reproduced on 6.10.0-rc7-100.ph5+, only getting repeated output as: # while true; do cat events/user_events/__test_event/format; done 2>/dev/null print fmt: "" name: __test_event ID: 2390 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; # while true; do ./kselftest/user_events/ftrace_test; done TAP version 13 1..6 # Starting 6 tests from 1 test cases. # RUN user.register_events ... # OK user.register_events ok 1 user.register_events # RUN user.write_events ... # OK user.write_events ok 2 user.write_events # RUN user.write_empty_events ... # OK user.write_empty_events ok 3 user.write_empty_events # RUN user.write_fault ... # OK user.write_fault ok 4 user.write_fault # RUN user.write_validator ... # OK user.write_validator ok 5 user.write_validator # RUN user.print_fmt ... # OK user.print_fmt ok 6 user.print_fmt # PASSED: 6 / 6 tests passed. # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 Am I missing any step? > Ignoring that the selftest fails for half of its tests -- which is a > regression and therefore yet another bug, I guess -- this triggers an > access fault (GFP/PF/NULL deref) after a few iterations, usually within > a minute, mostly mere seconds. With KASAN enabled it generates a splat > almost instantly, like following: > > [ 23.790955] ================================================================== > [ 23.791692] BUG: KASAN: slab-use-after-free in f_show+0x43b/0x470 > [ 23.792244] Read of size 8 at addr ffff888007076878 by task cat/755 > [ 23.792753] > [ 23.792947] CPU: 1 PID: 755 Comm: cat Tainted: G D N 6.10.0-vanilla-dirty #30 > [ 23.793563] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 > [ 23.794280] Call Trace: > [ 23.794470] <TASK> > [ 23.794642] dump_stack_lvl+0x66/0xa0 > [ 23.794909] print_report+0xd0/0x630 > [ 23.795180] ? f_show+0x43b/0x470 > [ 23.795415] ? __virt_addr_valid+0x208/0x3f0 > [ 23.795700] ? f_show+0x43b/0x470 > [ 23.795935] kasan_report+0xd8/0x110 > [ 23.796183] ? f_show+0x43b/0x470 > [ 23.796418] f_show+0x43b/0x470 > [ 23.796645] seq_read_iter+0x418/0x11e0 > [ 23.796907] ? __page_table_check_ptes_set+0x166/0x1a0 > [ 23.797280] seq_read+0x261/0x350 > [ 23.797537] ? lock_release+0x453/0x600 > [ 23.797819] ? __pfx_seq_read+0x10/0x10 > [ 23.798103] ? set_ptes.isra.0+0x11b/0x150 > [ 23.798402] vfs_read+0x171/0x9e0 > [ 23.798657] ? lock_acquire+0x408/0x4b0 > [ 23.798970] ? __pfx_vfs_read+0x10/0x10 > [ 23.799267] ? lock_release+0x453/0x600 > [ 23.799549] ? do_user_addr_fault+0x45b/0x8b0 > [ 23.799862] ? __pfx_lock_release+0x10/0x10 > [ 23.800162] ? __pfx___up_read+0x10/0x10 > [ 23.800448] ksys_read+0xdd/0x1a0 > [ 23.800704] ? __pfx_ksys_read+0x10/0x10 > [ 23.801007] ? do_user_addr_fault+0x465/0x8b0 > [ 23.801341] do_syscall_64+0x66/0x130 > [ 23.801615] entry_SYSCALL_64_after_hwframe+0x71/0x79 > [ 23.801959] RIP: 0033:0x7f1fdb9df40e > [ 23.802230] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 > [ 23.803352] RSP: 002b:00007fff86d62658 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 > [ 23.803848] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f1fdb9df40e > [ 23.804302] RDX: 0000000000020000 RSI: 00007f1fdb8d3000 RDI: 0000000000000003 > [ 23.804753] RBP: 00007f1fdb8d3000 R08: 00007f1fdb8d2010 R09: 0000000000000000 > [ 23.805239] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000 > [ 23.805694] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 > [ 23.806153] </TASK> > [ 23.806352] > [ 23.806518] Allocated by task 753: > [ 23.806781] kasan_save_stack+0x20/0x40 > [ 23.807094] kasan_save_track+0x14/0x30 > [ 23.807377] __kasan_kmalloc+0x8f/0xa0 > [ 23.807656] user_event_parse_cmd+0x590/0x25e0 > [ 23.807969] user_events_ioctl+0xa52/0x17f0 > [ 23.808267] __x64_sys_ioctl+0x133/0x190 > [ 23.808555] do_syscall_64+0x66/0x130 > [ 23.808830] entry_SYSCALL_64_after_hwframe+0x71/0x79 > [ 23.809208] > [ 23.809370] Freed by task 58: > [ 23.809609] kasan_save_stack+0x20/0x40 > [ 23.809890] kasan_save_track+0x14/0x30 > [ 23.810173] kasan_save_free_info+0x3b/0x60 > [ 23.810473] poison_slab_object+0x10a/0x170 > [ 23.810771] __kasan_slab_free+0x14/0x30 > [ 23.811090] kfree+0xe0/0x2f0 > [ 23.811338] destroy_user_event+0x305/0x450 > [ 23.811639] delayed_destroy_user_event+0x5c/0xe0 > [ 23.811965] process_one_work+0x81c/0x1970 > [ 23.812259] worker_thread+0x608/0x1160 > [ 23.812542] kthread+0x2be/0x3b0 > [ 23.812794] ret_from_fork+0x2c/0x70 > [ 23.813098] ret_from_fork_asm+0x1a/0x30 > [ 23.813387] > [ 23.813551] Last potentially related work creation: > [ 23.813885] kasan_save_stack+0x20/0x40 > [ 23.814168] __kasan_record_aux_stack+0x8e/0xa0 > [ 23.814489] insert_work+0x20/0x1b0 > [ 23.814756] __queue_work+0x67a/0xc60 > [ 23.815079] queue_work_on+0x63/0x90 > [ 23.815350] user_event_put+0x1f9/0x390 > [ 23.815631] user_events_ioctl+0x11ed/0x17f0 > [ 23.815935] __x64_sys_ioctl+0x133/0x190 > [ 23.816223] do_syscall_64+0x66/0x130 > [ 23.816498] entry_SYSCALL_64_after_hwframe+0x71/0x79 > [ 23.816841] > [ 23.817019] The buggy address belongs to the object at ffff888007076800 > [ 23.817019] which belongs to the cache kmalloc-cg-512 of size 512 > [ 23.817799] The buggy address is located 120 bytes inside of > [ 23.817799] freed 512-byte region [ffff888007076800, ffff888007076a00) > [ 23.818530] > [ 23.818694] The buggy address belongs to the physical page: > [ 23.819092] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7074 > [ 23.819602] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 > [ 23.820323] memcg:ffff88800277fd01 > [ 23.820595] anon flags: 0x40(head|zone=0) > [ 23.820885] page_type: 0xffffefff(slab) > [ 23.821203] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 0000000000000001 > [ 23.821706] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff88800277fd01 > [ 23.822206] head: 0000000000000040 ffff88800014cdc0 0000000000000000 0000000000000001 > [ 23.822711] head: 0000000000000000 0000000080100010 00000001ffffefff ffff88800277fd01 > [ 23.823261] head: 0000000000000002 ffffea00001c1d01 ffffffffffffffff 0000000000000000 > [ 23.823764] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000 > [ 23.824271] page dumped because: kasan: bad access detected > [ 23.824638] > [ 23.824799] Memory state around the buggy address: > [ 23.825162] ffff888007076700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > [ 23.825641] ffff888007076780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > [ 23.826116] >ffff888007076800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 23.826588] ^ > [ 23.827070] ffff888007076880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 23.827545] ffff888007076900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 23.828018] ================================================================== > > I did a bisect run and ended up on commit 27152bceea1d ("eventfs: Move > tracing/events to eventfs"). This is, of cause, only the enabling > commit. The bug is likely in one of the preceeding commits introducing > eventfs infrastructure. > > The git bisect log (I jumped around a little in the beginning, but yeah, > v6.10 is still broken): > > git bisect start > # status: waiting for both good and bad commits > # bad: [a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6] Linux 6.9 > git bisect bad a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 > # status: waiting for good commit(s), bad commit known > # bad: [0c3836482481200ead7b416ca80c68a29cfdaabd] Linux 6.10 > git bisect bad 0c3836482481200ead7b416ca80c68a29cfdaabd > # status: waiting for good commit(s), bad commit known > # bad: [ffc253263a1375a65fa6c9f62a893e9767fbebfa] Linux 6.6 > git bisect bad ffc253263a1375a65fa6c9f62a893e9767fbebfa > # status: waiting for good commit(s), bad commit known > # good: [6995e2de6891c724bfeb2db33d7b87775f913ad1] Linux 6.4 > git bisect good 6995e2de6891c724bfeb2db33d7b87775f913ad1 > # good: [692f5510159c79bfa312a4e27a15e266232bfb4c] Merge tag 'asoc-v6.6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus > git bisect good 692f5510159c79bfa312a4e27a15e266232bfb4c > # good: [0e72db77672ff4758a31fb5259c754a7bb229751] Merge tag 'soc-dt-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc > git bisect good 0e72db77672ff4758a31fb5259c754a7bb229751 > # bad: [5eea5820c7340d39e56e169e1b87199391105f6b] Merge tag 'mm-stable-2023-09-04-14-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > git bisect bad 5eea5820c7340d39e56e169e1b87199391105f6b > # good: [28a4f91f5f251689c69155bc6a0b1afc9916c874] Merge tag 'driver-core-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core > git bisect good 28a4f91f5f251689c69155bc6a0b1afc9916c874 > # bad: [f7e97ce26972ae7be8bbbae8d819ff311d4c5900] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma > git bisect bad f7e97ce26972ae7be8bbbae8d819ff311d4c5900 > # good: [9a5d660fdb25d20748d7f9e9559c86073c3bb368] media: ivsc: Add ACPI dependency > git bisect good 9a5d660fdb25d20748d7f9e9559c86073c3bb368 > # good: [704e2c6107f1a5353a1038bac137dda0df2a6dd0] Merge tag 'icc-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next > git bisect good 704e2c6107f1a5353a1038bac137dda0df2a6dd0 > # good: [bd30fe6a7d9b72e73c5ac9109cbc3066dde08034] Merge tag 'wq-for-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq > git bisect good bd30fe6a7d9b72e73c5ac9109cbc3066dde08034 > # good: [d952f54d01ec2ea5ee9d5e21f2ea3a5807b4bcbc] RDMA/hns: Remove unused declaration hns_roce_modify_srq() > git bisect good d952f54d01ec2ea5ee9d5e21f2ea3a5807b4bcbc > # bad: [34232fcfe9a383bea802af682baae5c99f22376c] Merge tag 'trace-v6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace > git bisect bad 34232fcfe9a383bea802af682baae5c99f22376c > # bad: [7c1130ea5cae215588e6d51242b877fd405e6c32] test: ftrace: Fix kprobe test for eventfs > git bisect bad 7c1130ea5cae215588e6d51242b877fd405e6c32 > # good: [5bdcd5f5331a276a3ddf1fba8605986d0d15298a] eventfs: Implement removal of meta data from eventfs > git bisect good 5bdcd5f5331a276a3ddf1fba8605986d0d15298a > # bad: [27152bceea1df27ffebb12ac9cd9adbf2c4c3f35] eventfs: Move tracing/events to eventfs > git bisect bad 27152bceea1df27ffebb12ac9cd9adbf2c4c3f35 > # first bad commit: [27152bceea1df27ffebb12ac9cd9adbf2c4c3f35] eventfs: Move tracing/events to eventfs > > I stared quite hard at the inode/dentry/file handling and, imho, it's > quite broken as it leaks pointers to refcounted objects which may go > away anytime, e.g. &user->call via trace_add_event_call() in > user_event_set_call_visible(). That'll lead to a user reachable file > hierarchy below events/user_events/$eventname/ that isn't bound to the > creator's mm. > > Assume one process opens events/user_events/$eventname/format, then the > walked fields -- the whole object, actually -- may go away anytime, once > the creator either removes the user probe again or closes its fd to > /sys/kernel/tracing/user_events_data, leading to user_events_release() > doing the final user_event_put() leading to object destruction. The > concurrent reader of events/user_events/$eventname/format will now > operate on a free'd object. Boom! > > As mentioned, I stared quite hard at the code and tried to fix it via > numerous ways but the core issue is, imho, the lack of refcounting the > &user->call object, or even better, 'user', for the files created below > events/user_events/$eventname/. However, I found no easy way to do that. > > My hopes are, you may be able to, now that there's an easy reproducer. > > Beside the obvious bug, I noticed the following (not fixing the issue, > tho): > > diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c > index 5d88c184f0fc..687ad0a26458 100644 > --- a/fs/tracefs/event_inode.c > +++ b/fs/tracefs/event_inode.c > @@ -112,7 +112,7 @@ static void release_ei(struct kref *ref) > entry->release(entry->name, ei->data); > } > > - call_rcu(&ei->rcu, free_ei_rcu); > + call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu); > } > > static inline void put_ei(struct eventfs_inode *ei) > @@ -735,7 +735,9 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode > > /* Was the parent freed? */ > if (list_empty(&ei->list)) { > + mutex_lock(&eventfs_mutex); > cleanup_ei(ei); > + mutex_unlock(&eventfs_mutex); > ei = NULL; > } > return ei; > > The s/call_rcu/call_srcu/ one is because not only do the comments talk > about SRCU protection, the code does so as well, e.g. eventfs_iterate(). > > Similar argumentation for taking the mutex around cleanup_ei(). It sets > the 'is_freed' member which others expect only to be set -- or at least > to have a stable value -- when the mutex is hold. As 'ei' was exposed to > its parent before, it may have escaped to other users, e.g. via > eventfs_iterate(). > > I may have missed something, painting these changes completely void, > therefore spared me the time to do proper patches. However, below one is > legit ("git am --scissors ..." yada yada): > > ---8<--- > Subject: [PATCH] eventfs: Don't return NULL in eventfs_create_dir() > > Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing > ei->dentry") added another check, testing if the parent was freed after > we released the mutex. If so, the function returns NULL. However, all > callers expect it to either return a valid pointer or an error pointer, > at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug > in event_subsystem_dir()"). Returning NULL will therefore fail the error > condition check in the caller. > > Fix this by substituting the NULL return value with a fitting error > pointer. > > Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") > Cc: Dan Carpenter <dan.carpenter@linaro.org> > Signed-off-by: Mathias Krause <minipli@grsecurity.net> > --- > fs/tracefs/event_inode.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c > index 5d88c184f0fc..a9c28a1d5dc8 100644 > --- a/fs/tracefs/event_inode.c > +++ b/fs/tracefs/event_inode.c > @@ -736,7 +736,7 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode > /* Was the parent freed? */ > if (list_empty(&ei->list)) { > cleanup_ei(ei); > - ei = NULL; > + ei = ERR_PTR(-EBUSY); > } > return ei; > } Must have. LGTM. Thanks. Reviewed-by: Ajay Kaher <ajay.kaher@broadcom.com> - Ajay
On 22.07.24 13:13, Ajay Kaher wrote: > On Sat, Jul 20, 2024 at 2:17 AM Mathias Krause <minipli@grsecurity.net> wrote: >> >> I noticed, the user events ftrace selftest is crashing every now and >> then in our automated tests. Digging into, I found that the following >> is triggering the issue very reliable: >> >> - in one shell, as root: >> # while true; do ./kselftest/user_events/ftrace_test; done >> >> - in a second shell, again as root: >> # cd /sys/kernel/tracing >> # while true; do cat events/user_events/__test_event/format; done 2>/dev/null >> > > Tried to reproduced on 6.10.0-rc7-100.ph5+, only getting repeated output as: I don't know what that version refers to, but, in case the .config matters, I'm attaching mine. It has KASAN enabled and works in a QEMU VM (Debian bullseye amd64 userland, in case it matters). > > # while true; do cat events/user_events/__test_event/format; done 2>/dev/null > print fmt: "" > name: __test_event > ID: 2390 > format: > field:unsigned short common_type; offset:0; size:2; signed:0; > field:unsigned char common_flags; offset:2; size:1; signed:0; > field:unsigned char common_preempt_count; offset:3; size:1; signed:0; > field:int common_pid; offset:4; size:4; signed:1; > > # while true; do ./kselftest/user_events/ftrace_test; done > TAP version 13 > 1..6 > # Starting 6 tests from 1 test cases. > # RUN user.register_events ... > # OK user.register_events > ok 1 user.register_events > # RUN user.write_events ... > # OK user.write_events > ok 2 user.write_events > # RUN user.write_empty_events ... > # OK user.write_empty_events > ok 3 user.write_empty_events > # RUN user.write_fault ... > # OK user.write_fault > ok 4 user.write_fault > # RUN user.write_validator ... > # OK user.write_validator > ok 5 user.write_validator > # RUN user.print_fmt ... > # OK user.print_fmt > ok 6 user.print_fmt > # PASSED: 6 / 6 tests passed. > # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 > > Am I missing any step? Hmm, for me the output looks like this: TAP version 13 1..6 # Starting 6 tests from 1 test cases. # RUN user.register_events ... # OK user.register_events ok 1 user.register_events # RUN user.write_events ... # ftrace_test.c:348:write_events:Expected after (515) > before (515) # write_events: Test terminated by assertion # FAIL user.write_events not ok 2 user.write_events # RUN user.write_empty_events ... # ftrace_test.c:386:write_empty_events:Expected after (515) > before (515) # write_empty_events: Test terminated by assertion # FAIL user.write_empty_events not ok 3 user.write_empty_events # RUN user.write_fault ... # OK user.write_fault ok 4 user.write_fault # RUN user.write_validator ... # ftrace_test.c:468:write_validator:Expected after (515) > before (515) # write_validator: Test terminated by assertion # FAIL user.write_validator not ok 5 user.write_validator # RUN user.print_fmt ... # OK user.print_fmt ok 6 user.print_fmt # FAILED: 3 / 6 tests passed. # Totals: pass:3 fail:3 xfail:0 xpass:0 skip:0 error:0 And that's v6.10 with only the additional patch from below applied on top. But even without any changes, plain v6.10 with my config triggers the bug easily. > >> Ignoring that the selftest fails for half of its tests -- which is a >> regression and therefore yet another bug, I guess -- this triggers an >> access fault (GFP/PF/NULL deref) after a few iterations, usually within >> a minute, mostly mere seconds. With KASAN enabled it generates a splat >> almost instantly, like following: >> >> [ 23.790955] ================================================================== >> [ 23.791692] BUG: KASAN: slab-use-after-free in f_show+0x43b/0x470 >> [...] >> [ 23.828018] ================================================================== If you add "kasan_multi_shot" you should see loads of reports in the kernel log while running both loops instead of only the first one. Thanks, Mathias # # Automatically generated file; DO NOT EDIT. # Linux/x86 6.10.0 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (Debian 13.3.0-1) 13.3.0" CONFIG_CC_IS_GCC=y CONFIG_GCC_VERSION=130300 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y CONFIG_AS_VERSION=24250 CONFIG_LD_IS_BFD=y CONFIG_LD_VERSION=24250 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y CONFIG_PAHOLE_VERSION=127 CONFIG_CONSTRUCTORS=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y # # General setup # CONFIG_INIT_ENV_ARG_LIMIT=32 # CONFIG_COMPILE_TEST is not set # CONFIG_WERROR is not set CONFIG_LOCALVERSION="-vanilla" # CONFIG_LOCALVERSION_AUTO is not set CONFIG_BUILD_SALT="" CONFIG_HAVE_KERNEL_GZIP=y CONFIG_HAVE_KERNEL_BZIP2=y CONFIG_HAVE_KERNEL_LZMA=y CONFIG_HAVE_KERNEL_XZ=y CONFIG_HAVE_KERNEL_LZO=y CONFIG_HAVE_KERNEL_LZ4=y CONFIG_HAVE_KERNEL_ZSTD=y CONFIG_KERNEL_GZIP=y # CONFIG_KERNEL_BZIP2 is not set # CONFIG_KERNEL_LZMA is not set # CONFIG_KERNEL_XZ is not set # CONFIG_KERNEL_LZO is not set # CONFIG_KERNEL_LZ4 is not set # CONFIG_KERNEL_ZSTD is not set CONFIG_DEFAULT_INIT="" CONFIG_DEFAULT_HOSTNAME="(none)" CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y CONFIG_SYSVIPC_COMPAT=y CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y # CONFIG_WATCH_QUEUE is not set CONFIG_CROSS_MEMORY_ATTACH=y # CONFIG_USELIB is not set CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y CONFIG_AUDITSYSCALL=y # # IRQ subsystem # CONFIG_GENERIC_IRQ_PROBE=y CONFIG_GENERIC_IRQ_SHOW=y CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y CONFIG_GENERIC_PENDING_IRQ=y CONFIG_GENERIC_IRQ_MIGRATION=y CONFIG_HARDIRQS_SW_RESEND=y CONFIG_IRQ_DOMAIN=y CONFIG_IRQ_DOMAIN_HIERARCHY=y CONFIG_GENERIC_MSI_IRQ=y CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y CONFIG_GENERIC_IRQ_RESERVATION_MODE=y CONFIG_IRQ_FORCED_THREADING=y CONFIG_SPARSE_IRQ=y # CONFIG_GENERIC_IRQ_DEBUGFS is not set # end of IRQ subsystem CONFIG_CLOCKSOURCE_WATCHDOG=y CONFIG_ARCH_CLOCKSOURCE_INIT=y CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y CONFIG_GENERIC_TIME_VSYSCALL=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y CONFIG_GENERIC_CMOS_UPDATE=y CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y # CONFIG_TIME_KUNIT_TEST is not set CONFIG_CONTEXT_TRACKING=y CONFIG_CONTEXT_TRACKING_IDLE=y # # Timers subsystem # CONFIG_TICK_ONESHOT=y CONFIG_NO_HZ_COMMON=y # CONFIG_HZ_PERIODIC is not set # CONFIG_NO_HZ_IDLE is not set CONFIG_NO_HZ_FULL=y CONFIG_CONTEXT_TRACKING_USER=y # CONFIG_CONTEXT_TRACKING_USER_FORCE is not set # CONFIG_NO_HZ is not set CONFIG_HIGH_RES_TIMERS=y CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=100 # end of Timers subsystem CONFIG_BPF=y CONFIG_HAVE_EBPF_JIT=y CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y # # BPF subsystem # CONFIG_BPF_SYSCALL=y # CONFIG_BPF_JIT is not set CONFIG_BPF_UNPRIV_DEFAULT_OFF=y # CONFIG_BPF_PRELOAD is not set # end of BPF subsystem CONFIG_PREEMPT_BUILD=y # CONFIG_PREEMPT_NONE is not set # CONFIG_PREEMPT_VOLUNTARY is not set CONFIG_PREEMPT=y CONFIG_PREEMPT_COUNT=y CONFIG_PREEMPTION=y CONFIG_PREEMPT_DYNAMIC=y CONFIG_SCHED_CORE=y # # CPU/Task time and stats accounting # CONFIG_VIRT_CPU_ACCOUNTING=y CONFIG_VIRT_CPU_ACCOUNTING_GEN=y # CONFIG_IRQ_TIME_ACCOUNTING is not set CONFIG_BSD_PROCESS_ACCT=y CONFIG_BSD_PROCESS_ACCT_V3=y CONFIG_TASKSTATS=y CONFIG_TASK_DELAY_ACCT=y CONFIG_TASK_XACCT=y CONFIG_TASK_IO_ACCOUNTING=y CONFIG_PSI=y # CONFIG_PSI_DEFAULT_DISABLED is not set # end of CPU/Task time and stats accounting CONFIG_CPU_ISOLATION=y # # RCU Subsystem # CONFIG_TREE_RCU=y CONFIG_PREEMPT_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_TREE_SRCU=y CONFIG_TASKS_RCU_GENERIC=y CONFIG_NEED_TASKS_RCU=y CONFIG_TASKS_RCU=y CONFIG_TASKS_TRACE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y CONFIG_RCU_NOCB_CPU=y # CONFIG_RCU_NOCB_CPU_DEFAULT_ALL is not set # CONFIG_RCU_LAZY is not set # end of RCU Subsystem CONFIG_IKCONFIG=y CONFIG_IKCONFIG_PROC=y # CONFIG_IKHEADERS is not set CONFIG_LOG_BUF_SHIFT=17 CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 # CONFIG_PRINTK_INDEX is not set CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y # # Scheduler features # # CONFIG_UCLAMP_TASK is not set # end of Scheduler features CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_CC_HAS_INT128=y CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" CONFIG_GCC10_NO_ARRAY_BOUNDS=y CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_GCC_NO_STRINGOP_OVERFLOW=y CONFIG_CC_NO_STRINGOP_OVERFLOW=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_SLAB_OBJ_EXT=y CONFIG_CGROUPS=y CONFIG_PAGE_COUNTER=y CONFIG_CGROUP_FAVOR_DYNMODS=y CONFIG_MEMCG=y CONFIG_MEMCG_KMEM=y CONFIG_BLK_CGROUP=y CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_SCHED=y CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_SCHED_MM_CID=y CONFIG_CGROUP_PIDS=y # CONFIG_CGROUP_RDMA is not set CONFIG_CGROUP_FREEZER=y CONFIG_CGROUP_HUGETLB=y CONFIG_CPUSETS=y CONFIG_PROC_PID_CPUSET=y CONFIG_CGROUP_DEVICE=y CONFIG_CGROUP_CPUACCT=y CONFIG_CGROUP_PERF=y CONFIG_CGROUP_BPF=y CONFIG_CGROUP_MISC=y CONFIG_CGROUP_DEBUG=y CONFIG_SOCK_CGROUP_DATA=y CONFIG_NAMESPACES=y CONFIG_UTS_NS=y CONFIG_TIME_NS=y CONFIG_IPC_NS=y # CONFIG_USER_NS is not set CONFIG_PID_NS=y CONFIG_NET_NS=y # CONFIG_CHECKPOINT_RESTORE is not set # CONFIG_SCHED_AUTOGROUP is not set CONFIG_RELAY=y CONFIG_BLK_DEV_INITRD=y CONFIG_INITRAMFS_SOURCE="" CONFIG_RD_GZIP=y CONFIG_RD_BZIP2=y CONFIG_RD_LZMA=y CONFIG_RD_XZ=y CONFIG_RD_LZO=y CONFIG_RD_LZ4=y CONFIG_RD_ZSTD=y # CONFIG_BOOT_CONFIG is not set CONFIG_INITRAMFS_PRESERVE_MTIME=y CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set CONFIG_LD_ORPHAN_WARN=y CONFIG_LD_ORPHAN_WARN_LEVEL="warn" CONFIG_SYSCTL=y CONFIG_HAVE_UID16=y CONFIG_SYSCTL_EXCEPTION_TRACE=y CONFIG_HAVE_PCSPKR_PLATFORM=y CONFIG_EXPERT=y CONFIG_UID16=y CONFIG_MULTIUSER=y CONFIG_SGETMASK_SYSCALL=y # CONFIG_SYSFS_SYSCALL is not set CONFIG_FHANDLE=y CONFIG_POSIX_TIMERS=y CONFIG_PRINTK=y CONFIG_BUG=y CONFIG_ELF_CORE=y # CONFIG_PCSPKR_PLATFORM is not set # CONFIG_BASE_SMALL is not set CONFIG_FUTEX=y CONFIG_FUTEX_PI=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y CONFIG_EVENTFD=y CONFIG_SHMEM=y CONFIG_AIO=y CONFIG_IO_URING=y CONFIG_ADVISE_SYSCALLS=y CONFIG_MEMBARRIER=y CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_DEBUG_RSEQ is not set CONFIG_CACHESTAT_SYSCALL=y # CONFIG_PC104 is not set CONFIG_KALLSYMS=y # CONFIG_KALLSYMS_SELFTEST is not set CONFIG_KALLSYMS_ALL=y CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y CONFIG_KALLSYMS_BASE_RELATIVE=y CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y CONFIG_HAVE_PERF_EVENTS=y CONFIG_GUEST_PERF_EVENTS=y # # Kernel Performance Events And Counters # CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set # end of Kernel Performance Events And Counters # CONFIG_PROFILING is not set CONFIG_TRACEPOINTS=y # # Kexec and crash features # # CONFIG_KEXEC is not set # CONFIG_KEXEC_FILE is not set # end of Kexec and crash features # end of General setup CONFIG_64BIT=y CONFIG_X86_64=y CONFIG_X86=y CONFIG_INSTRUCTION_DECODER=y CONFIG_OUTPUT_FORMAT="elf64-x86-64" CONFIG_LOCKDEP_SUPPORT=y CONFIG_STACKTRACE_SUPPORT=y CONFIG_MMU=y CONFIG_ARCH_MMAP_RND_BITS_MIN=28 CONFIG_ARCH_MMAP_RND_BITS_MAX=32 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 CONFIG_GENERIC_CSUM=y CONFIG_GENERIC_BUG=y CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y CONFIG_GENERIC_CALIBRATE_DELAY=y CONFIG_ARCH_HAS_CPU_RELAX=y CONFIG_ARCH_HIBERNATION_POSSIBLE=y CONFIG_ARCH_SUSPEND_POSSIBLE=y CONFIG_AUDIT_ARCH=y CONFIG_KASAN_SHADOW_OFFSET=0xdffffc0000000000 CONFIG_X86_64_SMP=y CONFIG_ARCH_SUPPORTS_UPROBES=y CONFIG_FIX_EARLYCON_MEM=y CONFIG_PGTABLE_LEVELS=5 CONFIG_CC_HAS_SANE_STACKPROTECTOR=y # # Processor type and features # CONFIG_SMP=y CONFIG_X86_X2APIC=y CONFIG_X86_MPPARSE=y CONFIG_X86_CPU_RESCTRL=y # CONFIG_X86_FRED is not set # CONFIG_X86_EXTENDED_PLATFORM is not set CONFIG_X86_INTEL_LPSS=y # CONFIG_X86_AMD_PLATFORM_DEVICE is not set CONFIG_IOSF_MBI=y # CONFIG_IOSF_MBI_DEBUG is not set CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y CONFIG_SCHED_OMIT_FRAME_POINTER=y CONFIG_HYPERVISOR_GUEST=y # CONFIG_PARAVIRT is not set CONFIG_ARCH_CPUIDLE_HALTPOLL=y # CONFIG_PVH is not set # CONFIG_JAILHOUSE_GUEST is not set # CONFIG_ACRN_GUEST is not set # CONFIG_INTEL_TDX_GUEST is not set # CONFIG_MK8 is not set # CONFIG_MPSC is not set CONFIG_MCORE2=y # CONFIG_MATOM is not set # CONFIG_GENERIC_CPU is not set CONFIG_X86_INTERNODE_CACHE_SHIFT=6 CONFIG_X86_L1_CACHE_SHIFT=6 CONFIG_X86_INTEL_USERCOPY=y CONFIG_X86_USE_PPRO_CHECKSUM=y CONFIG_X86_P6_NOP=y CONFIG_X86_TSC=y CONFIG_X86_HAVE_PAE=y CONFIG_X86_CMPXCHG64=y CONFIG_X86_CMOV=y CONFIG_X86_MINIMUM_CPU_FAMILY=64 CONFIG_X86_DEBUGCTLMSR=y CONFIG_IA32_FEAT_CTL=y CONFIG_X86_VMX_FEATURE_NAMES=y CONFIG_PROCESSOR_SELECT=y CONFIG_CPU_SUP_INTEL=y # CONFIG_CPU_SUP_AMD is not set # CONFIG_CPU_SUP_HYGON is not set # CONFIG_CPU_SUP_CENTAUR is not set # CONFIG_CPU_SUP_ZHAOXIN is not set CONFIG_HPET_TIMER=y CONFIG_DMI=y # CONFIG_MAXSMP is not set CONFIG_NR_CPUS_RANGE_BEGIN=2 CONFIG_NR_CPUS_RANGE_END=512 CONFIG_NR_CPUS_DEFAULT=64 CONFIG_NR_CPUS=64 CONFIG_SCHED_CLUSTER=y CONFIG_SCHED_SMT=y CONFIG_SCHED_MC=y CONFIG_SCHED_MC_PRIO=y CONFIG_X86_LOCAL_APIC=y CONFIG_X86_IO_APIC=y CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y CONFIG_X86_MCE=y CONFIG_X86_MCELOG_LEGACY=y CONFIG_X86_MCE_INTEL=y CONFIG_X86_MCE_THRESHOLD=y # CONFIG_X86_MCE_INJECT is not set # # Performance monitoring # CONFIG_PERF_EVENTS_INTEL_UNCORE=y CONFIG_PERF_EVENTS_INTEL_RAPL=y CONFIG_PERF_EVENTS_INTEL_CSTATE=y # end of Performance monitoring CONFIG_X86_VSYSCALL_EMULATION=y CONFIG_X86_IOPL_IOPERM=y CONFIG_MICROCODE=y # CONFIG_MICROCODE_LATE_LOADING is not set # CONFIG_X86_MSR is not set # CONFIG_X86_CPUID is not set CONFIG_X86_5LEVEL=y CONFIG_X86_DIRECT_GBPAGES=y # CONFIG_X86_CPA_STATISTICS is not set # CONFIG_NUMA is not set CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_ARCH_SPARSEMEM_DEFAULT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 CONFIG_X86_PMEM_LEGACY_DEVICE=y CONFIG_X86_PMEM_LEGACY=y CONFIG_X86_CHECK_BIOS_CORRUPTION=y CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y CONFIG_MTRR=y CONFIG_MTRR_SANITIZER=y CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 CONFIG_X86_PAT=y CONFIG_ARCH_USES_PG_UNCACHED=y CONFIG_X86_UMIP=y CONFIG_CC_HAS_IBT=y CONFIG_X86_CET=y CONFIG_X86_KERNEL_IBT=y CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y CONFIG_X86_INTEL_TSX_MODE_OFF=y # CONFIG_X86_INTEL_TSX_MODE_ON is not set # CONFIG_X86_INTEL_TSX_MODE_AUTO is not set CONFIG_X86_SGX=y # CONFIG_X86_USER_SHADOW_STACK is not set CONFIG_EFI=y CONFIG_EFI_STUB=y CONFIG_EFI_HANDOVER_PROTOCOL=y CONFIG_EFI_MIXED=y # CONFIG_EFI_FAKE_MEMMAP is not set # CONFIG_EFI_RUNTIME_MAP is not set # CONFIG_HZ_100 is not set CONFIG_HZ_250=y # CONFIG_HZ_300 is not set # CONFIG_HZ_1000 is not set CONFIG_HZ=250 CONFIG_SCHED_HRTICK=y CONFIG_ARCH_SUPPORTS_KEXEC=y CONFIG_ARCH_SUPPORTS_KEXEC_FILE=y CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY=y CONFIG_ARCH_SUPPORTS_KEXEC_SIG=y CONFIG_ARCH_SUPPORTS_KEXEC_SIG_FORCE=y CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG=y CONFIG_ARCH_SUPPORTS_KEXEC_JUMP=y CONFIG_ARCH_SUPPORTS_CRASH_DUMP=y CONFIG_ARCH_SUPPORTS_CRASH_HOTPLUG=y CONFIG_PHYSICAL_START=0x1000000 CONFIG_RELOCATABLE=y CONFIG_RANDOMIZE_BASE=y CONFIG_X86_NEED_RELOCS=y CONFIG_PHYSICAL_ALIGN=0x1000000 CONFIG_DYNAMIC_MEMORY_LAYOUT=y CONFIG_RANDOMIZE_MEMORY=y CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0x0 # CONFIG_ADDRESS_MASKING is not set CONFIG_HOTPLUG_CPU=y # CONFIG_COMPAT_VDSO is not set CONFIG_LEGACY_VSYSCALL_XONLY=y # CONFIG_LEGACY_VSYSCALL_NONE is not set CONFIG_CMDLINE_BOOL=y CONFIG_CMDLINE="pax_size_overflow_report_only pax_kstack_report_only panic=10" # CONFIG_CMDLINE_OVERRIDE is not set # CONFIG_MODIFY_LDT_SYSCALL is not set CONFIG_STRICT_SIGALTSTACK_SIZE=y CONFIG_HAVE_LIVEPATCH=y # end of Processor type and features CONFIG_CC_HAS_NAMED_AS=y CONFIG_CC_HAS_NAMED_AS_FIXED_SANITIZERS=y CONFIG_USE_X86_SEG_SUPPORT=y CONFIG_CC_HAS_SLS=y CONFIG_CC_HAS_RETURN_THUNK=y CONFIG_CC_HAS_ENTRY_PADDING=y CONFIG_FUNCTION_PADDING_CFI=11 CONFIG_FUNCTION_PADDING_BYTES=16 CONFIG_CALL_PADDING=y CONFIG_HAVE_CALL_THUNKS=y CONFIG_CALL_THUNKS=y CONFIG_PREFIX_SYMBOLS=y CONFIG_CPU_MITIGATIONS=y CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y CONFIG_MITIGATION_RETPOLINE=y CONFIG_MITIGATION_RETHUNK=y CONFIG_MITIGATION_CALL_DEPTH_TRACKING=y # CONFIG_CALL_THUNKS_DEBUG is not set CONFIG_MITIGATION_IBRS_ENTRY=y # CONFIG_MITIGATION_SLS is not set # CONFIG_MITIGATION_GDS_FORCE is not set CONFIG_MITIGATION_RFDS=y CONFIG_MITIGATION_SPECTRE_BHI=y CONFIG_ARCH_HAS_ADD_PAGES=y # # Power management and ACPI options # # CONFIG_SUSPEND is not set # CONFIG_HIBERNATION is not set # CONFIG_PM is not set # CONFIG_ENERGY_MODEL is not set CONFIG_ARCH_SUPPORTS_ACPI=y CONFIG_ACPI=y CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y # CONFIG_ACPI_DEBUGGER is not set # CONFIG_ACPI_SPCR_TABLE is not set CONFIG_ACPI_FPDT=y CONFIG_ACPI_LPIT=y # CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set # CONFIG_ACPI_EC_DEBUGFS is not set # CONFIG_ACPI_AC is not set # CONFIG_ACPI_BATTERY is not set CONFIG_ACPI_BUTTON=y CONFIG_ACPI_FAN=y # CONFIG_ACPI_DOCK is not set CONFIG_ACPI_CPU_FREQ_PSS=y CONFIG_ACPI_PROCESSOR_CSTATE=y CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_HOTPLUG_CPU=y # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set # CONFIG_ACPI_THERMAL is not set CONFIG_ACPI_CUSTOM_DSDT_FILE="" CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y # CONFIG_ACPI_TABLE_UPGRADE is not set # CONFIG_ACPI_DEBUG is not set # CONFIG_ACPI_PCI_SLOT is not set CONFIG_ACPI_CONTAINER=y CONFIG_ACPI_HOTPLUG_IOAPIC=y # CONFIG_ACPI_SBS is not set # CONFIG_ACPI_HED is not set # CONFIG_ACPI_BGRT is not set # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set # CONFIG_ACPI_NFIT is not set CONFIG_HAVE_ACPI_APEI=y CONFIG_HAVE_ACPI_APEI_NMI=y CONFIG_ACPI_APEI=y # CONFIG_ACPI_APEI_GHES is not set # CONFIG_ACPI_APEI_EINJ is not set # CONFIG_ACPI_APEI_ERST_DEBUG is not set # CONFIG_ACPI_DPTF is not set # CONFIG_ACPI_CONFIGFS is not set CONFIG_ACPI_PFRUT=y CONFIG_ACPI_PCC=y # CONFIG_ACPI_FFH is not set # CONFIG_PMIC_OPREGION is not set CONFIG_ACPI_PRMT=y CONFIG_X86_PM_TIMER=y # # CPU Frequency scaling # CONFIG_CPU_FREQ=y CONFIG_CPU_FREQ_GOV_ATTR_SET=y CONFIG_CPU_FREQ_GOV_COMMON=y # CONFIG_CPU_FREQ_STAT is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y CONFIG_CPU_FREQ_GOV_PERFORMANCE=y # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set # CONFIG_CPU_FREQ_GOV_USERSPACE is not set CONFIG_CPU_FREQ_GOV_ONDEMAND=y # CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y # # CPU frequency scaling drivers # CONFIG_X86_INTEL_PSTATE=y # CONFIG_X86_PCC_CPUFREQ is not set # CONFIG_X86_AMD_PSTATE is not set # CONFIG_X86_AMD_PSTATE_UT is not set CONFIG_X86_ACPI_CPUFREQ=y # CONFIG_X86_POWERNOW_K8 is not set # CONFIG_X86_SPEEDSTEP_CENTRINO is not set # CONFIG_X86_P4_CLOCKMOD is not set # # shared options # # end of CPU Frequency scaling # # CPU Idle # CONFIG_CPU_IDLE=y CONFIG_CPU_IDLE_GOV_LADDER=y CONFIG_CPU_IDLE_GOV_MENU=y # CONFIG_CPU_IDLE_GOV_TEO is not set # end of CPU Idle CONFIG_INTEL_IDLE=y # end of Power management and ACPI options # # Bus options (PCI etc.) # CONFIG_PCI_DIRECT=y CONFIG_PCI_MMCONFIG=y CONFIG_MMCONF_FAM10H=y # CONFIG_PCI_CNB20LE_QUIRK is not set # CONFIG_ISA_BUS is not set # CONFIG_ISA_DMA_API is not set # end of Bus options (PCI etc.) # # Binary Emulations # CONFIG_IA32_EMULATION=y # CONFIG_IA32_EMULATION_DEFAULT_DISABLED is not set # CONFIG_X86_X32_ABI is not set CONFIG_COMPAT_32=y CONFIG_COMPAT=y CONFIG_COMPAT_FOR_U64_ALIGNMENT=y # end of Binary Emulations CONFIG_KVM_COMMON=y CONFIG_HAVE_KVM_PFNCACHE=y CONFIG_HAVE_KVM_IRQCHIP=y CONFIG_HAVE_KVM_IRQ_ROUTING=y CONFIG_HAVE_KVM_DIRTY_RING=y CONFIG_HAVE_KVM_DIRTY_RING_TSO=y CONFIG_HAVE_KVM_DIRTY_RING_ACQ_REL=y CONFIG_KVM_MMIO=y CONFIG_KVM_ASYNC_PF=y CONFIG_HAVE_KVM_MSI=y CONFIG_HAVE_KVM_READONLY_MEM=y CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y CONFIG_KVM_VFIO=y CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y CONFIG_KVM_COMPAT=y CONFIG_HAVE_KVM_IRQ_BYPASS=y CONFIG_HAVE_KVM_NO_POLL=y CONFIG_KVM_XFER_TO_GUEST_WORK=y CONFIG_KVM_GENERIC_HARDWARE_ENABLING=y CONFIG_KVM_GENERIC_MMU_NOTIFIER=y CONFIG_VIRTUALIZATION=y CONFIG_KVM=y # CONFIG_KVM_SW_PROTECTED_VM is not set CONFIG_KVM_INTEL=y # CONFIG_KVM_INTEL_PROVE_VE is not set CONFIG_X86_SGX_KVM=y CONFIG_KVM_SMM=y CONFIG_KVM_HYPERV=y # CONFIG_KVM_XEN is not set # CONFIG_KVM_PROVE_MMU is not set CONFIG_KVM_MAX_NR_VCPUS=1024 CONFIG_AS_AVX512=y CONFIG_AS_SHA1_NI=y CONFIG_AS_SHA256_NI=y CONFIG_AS_TPAUSE=y CONFIG_AS_GFNI=y CONFIG_AS_VAES=y CONFIG_AS_VPCLMULQDQ=y CONFIG_AS_WRUSS=y CONFIG_ARCH_CONFIGURES_CPU_MITIGATIONS=y # # General architecture-dependent options # CONFIG_HOTPLUG_SMT=y CONFIG_HOTPLUG_CORE_SYNC=y CONFIG_HOTPLUG_CORE_SYNC_DEAD=y CONFIG_HOTPLUG_CORE_SYNC_FULL=y CONFIG_HOTPLUG_SPLIT_STARTUP=y CONFIG_HOTPLUG_PARALLEL=y CONFIG_GENERIC_ENTRY=y CONFIG_KPROBES=y CONFIG_JUMP_LABEL=y # CONFIG_STATIC_KEYS_SELFTEST is not set # CONFIG_STATIC_CALL_SELFTEST is not set CONFIG_OPTPROBES=y CONFIG_UPROBES=y CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y CONFIG_KRETPROBES=y CONFIG_KRETPROBE_ON_RETHOOK=y CONFIG_USER_RETURN_NOTIFIER=y CONFIG_HAVE_IOREMAP_PROT=y CONFIG_HAVE_KPROBES=y CONFIG_HAVE_KRETPROBES=y CONFIG_HAVE_OPTPROBES=y CONFIG_HAVE_KPROBES_ON_FTRACE=y CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y CONFIG_HAVE_NMI=y CONFIG_TRACE_IRQFLAGS_SUPPORT=y CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y CONFIG_HAVE_ARCH_TRACEHOOK=y CONFIG_HAVE_DMA_CONTIGUOUS=y CONFIG_GENERIC_SMP_IDLE_THREAD=y CONFIG_ARCH_HAS_FORTIFY_SOURCE=y CONFIG_ARCH_HAS_SET_MEMORY=y CONFIG_ARCH_HAS_SET_DIRECT_MAP=y CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y CONFIG_ARCH_WANTS_NO_INSTR=y CONFIG_HAVE_ASM_MODVERSIONS=y CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y CONFIG_HAVE_RSEQ=y CONFIG_HAVE_RUST=y CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y CONFIG_HAVE_HW_BREAKPOINT=y CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y CONFIG_HAVE_USER_RETURN_NOTIFIER=y CONFIG_HAVE_PERF_EVENTS_NMI=y CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y CONFIG_MMU_GATHER_MERGE_VMAS=y CONFIG_MMU_LAZY_TLB_REFCOUNT=y CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS=y CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y CONFIG_HAVE_CMPXCHG_LOCAL=y CONFIG_HAVE_CMPXCHG_DOUBLE=y CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y CONFIG_HAVE_ARCH_SECCOMP=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y CONFIG_SECCOMP=y CONFIG_SECCOMP_FILTER=y CONFIG_SECCOMP_CACHE_DEBUG=y CONFIG_HAVE_ARCH_STACKLEAK=y CONFIG_HAVE_STACKPROTECTOR=y # CONFIG_STACKPROTECTOR is not set CONFIG_ARCH_SUPPORTS_LTO_CLANG=y CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y CONFIG_LTO_NONE=y CONFIG_ARCH_SUPPORTS_CFI_CLANG=y CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y CONFIG_HAVE_CONTEXT_TRACKING_USER=y CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y CONFIG_HAVE_MOVE_PUD=y CONFIG_HAVE_MOVE_PMD=y CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD=y CONFIG_HAVE_ARCH_HUGE_VMAP=y CONFIG_HAVE_ARCH_HUGE_VMALLOC=y CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y CONFIG_ARCH_WANT_PMD_MKWRITE=y CONFIG_HAVE_ARCH_SOFT_DIRTY=y CONFIG_HAVE_MOD_ARCH_SPECIFIC=y CONFIG_MODULES_USE_ELF_RELA=y CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y CONFIG_SOFTIRQ_ON_OWN_STACK=y CONFIG_ARCH_HAS_ELF_RANDOMIZE=y CONFIG_HAVE_ARCH_MMAP_RND_BITS=y CONFIG_HAVE_EXIT_THREAD=y CONFIG_ARCH_MMAP_RND_BITS=28 CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8 CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES=y CONFIG_HAVE_PAGE_SIZE_4KB=y CONFIG_PAGE_SIZE_4KB=y CONFIG_PAGE_SIZE_LESS_THAN_64KB=y CONFIG_PAGE_SIZE_LESS_THAN_256KB=y CONFIG_PAGE_SHIFT=12 CONFIG_HAVE_OBJTOOL=y CONFIG_HAVE_JUMP_LABEL_HACK=y CONFIG_HAVE_NOINSTR_HACK=y CONFIG_HAVE_NOINSTR_VALIDATION=y CONFIG_HAVE_UACCESS_VALIDATION=y CONFIG_HAVE_STACK_VALIDATION=y CONFIG_HAVE_RELIABLE_STACKTRACE=y CONFIG_OLD_SIGSUSPEND3=y CONFIG_COMPAT_OLD_SIGACTION=y # CONFIG_COMPAT_32BIT_TIME is not set CONFIG_HAVE_ARCH_VMAP_STACK=y CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y # CONFIG_RANDOMIZE_KSTACK_OFFSET is not set CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y CONFIG_STRICT_KERNEL_RWX=y CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y CONFIG_STRICT_MODULE_RWX=y CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y CONFIG_ARCH_USE_MEMREMAP_PROT=y # CONFIG_LOCK_EVENT_COUNTS is not set CONFIG_ARCH_HAS_MEM_ENCRYPT=y CONFIG_HAVE_STATIC_CALL=y CONFIG_HAVE_STATIC_CALL_INLINE=y CONFIG_HAVE_PREEMPT_DYNAMIC=y CONFIG_HAVE_PREEMPT_DYNAMIC_CALL=y CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y CONFIG_ARCH_HAS_ELFCORE_COMPAT=y CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y CONFIG_DYNAMIC_SIGFRAME=y CONFIG_HAVE_ARCH_NODE_DEV_GROUP=y CONFIG_ARCH_HAS_HW_PTE_YOUNG=y CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y CONFIG_ARCH_HAS_KERNEL_FPU_SUPPORT=y # # GCOV-based kernel profiling # # CONFIG_GCOV_KERNEL is not set CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y # end of GCOV-based kernel profiling CONFIG_HAVE_GCC_PLUGINS=y # CONFIG_GCC_PLUGINS is not set CONFIG_FUNCTION_ALIGNMENT_4B=y CONFIG_FUNCTION_ALIGNMENT_16B=y CONFIG_FUNCTION_ALIGNMENT=16 # end of General architecture-dependent options CONFIG_RT_MUTEXES=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set # CONFIG_MODULE_UNLOAD is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set # CONFIG_MODULE_SIG is not set CONFIG_MODULE_COMPRESS_NONE=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set # CONFIG_MODULE_COMPRESS_ZSTD is not set # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y CONFIG_BLOCK_LEGACY_AUTOLOAD=y CONFIG_BLK_RQ_ALLOC_TIME=y CONFIG_BLK_CGROUP_RWSTAT=y CONFIG_BLK_DEV_BSG_COMMON=y CONFIG_BLK_ICQ=y # CONFIG_BLK_DEV_BSGLIB is not set CONFIG_BLK_DEV_INTEGRITY=y CONFIG_BLK_DEV_INTEGRITY_T10=y CONFIG_BLK_DEV_WRITE_MOUNTED=y CONFIG_BLK_DEV_ZONED=y # CONFIG_BLK_DEV_THROTTLING is not set # CONFIG_BLK_WBT is not set CONFIG_BLK_CGROUP_IOLATENCY=y CONFIG_BLK_CGROUP_IOCOST=y CONFIG_BLK_CGROUP_IOPRIO=y # CONFIG_BLK_DEBUG_FS is not set # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set # # Partition Types # # CONFIG_PARTITION_ADVANCED is not set CONFIG_MSDOS_PARTITION=y CONFIG_EFI_PARTITION=y # end of Partition Types CONFIG_BLK_MQ_PCI=y CONFIG_BLK_MQ_VIRTIO=y # # IO Schedulers # CONFIG_MQ_IOSCHED_DEADLINE=y CONFIG_MQ_IOSCHED_KYBER=y CONFIG_IOSCHED_BFQ=y CONFIG_BFQ_GROUP_IOSCHED=y CONFIG_BFQ_CGROUP_DEBUG=y # end of IO Schedulers CONFIG_PREEMPT_NOTIFIERS=y CONFIG_PADATA=y CONFIG_UNINLINE_SPIN_UNLOCK=y CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y CONFIG_MUTEX_SPIN_ON_OWNER=y CONFIG_RWSEM_SPIN_ON_OWNER=y CONFIG_LOCK_SPIN_ON_OWNER=y CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y CONFIG_QUEUED_SPINLOCKS=y CONFIG_ARCH_USE_QUEUED_RWLOCKS=y CONFIG_QUEUED_RWLOCKS=y CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y CONFIG_FREEZER=y # # Executable file formats # CONFIG_BINFMT_ELF=y CONFIG_BINFMT_ELF_KUNIT_TEST=y CONFIG_COMPAT_BINFMT_ELF=y CONFIG_ELFCORE=y CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y CONFIG_BINFMT_SCRIPT=y # CONFIG_BINFMT_MISC is not set CONFIG_COREDUMP=y # end of Executable file formats # # Memory Management options # CONFIG_SWAP=y # CONFIG_ZSWAP is not set # # Slab allocator options # CONFIG_SLUB=y # CONFIG_SLUB_TINY is not set # CONFIG_SLAB_MERGE_DEFAULT is not set CONFIG_SLAB_FREELIST_RANDOM=y CONFIG_SLAB_FREELIST_HARDENED=y # CONFIG_SLUB_STATS is not set CONFIG_SLUB_CPU_PARTIAL=y # CONFIG_RANDOM_KMALLOC_CACHES is not set # end of Slab allocator options CONFIG_SHUFFLE_PAGE_ALLOCATOR=y # CONFIG_COMPAT_BRK is not set CONFIG_SPARSEMEM=y CONFIG_SPARSEMEM_EXTREME=y CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y CONFIG_SPARSEMEM_VMEMMAP=y CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=y CONFIG_ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP=y CONFIG_HAVE_GUP_FAST=y CONFIG_EXCLUSIVE_SYSTEM_RAM=y CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y # CONFIG_MEMORY_HOTPLUG is not set CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y CONFIG_SPLIT_PTLOCK_CPUS=4 CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y CONFIG_COMPACTION=y CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1 CONFIG_PAGE_REPORTING=y CONFIG_MIGRATION=y CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y CONFIG_ARCH_ENABLE_THP_MIGRATION=y CONFIG_PCP_BATCH_SCALE_MAX=5 CONFIG_PHYS_ADDR_T_64BIT=y CONFIG_MMU_NOTIFIER=y # CONFIG_KSM is not set CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y # CONFIG_MEMORY_FAILURE is not set CONFIG_ARCH_WANT_GENERAL_HUGETLB=y CONFIG_ARCH_WANTS_THP_SWAP=y CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y # CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set # CONFIG_TRANSPARENT_HUGEPAGE_NEVER is not set CONFIG_THP_SWAP=y CONFIG_READ_ONLY_THP_FOR_FS=y CONFIG_PGTABLE_HAS_HUGE_LEAVES=y CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y CONFIG_HAVE_SETUP_PER_CPU_AREA=y # CONFIG_CMA is not set CONFIG_GENERIC_EARLY_IOREMAP=y CONFIG_DEFERRED_STRUCT_PAGE_INIT=y CONFIG_PAGE_IDLE_FLAG=y # CONFIG_IDLE_PAGE_TRACKING is not set CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y CONFIG_ARCH_HAS_PTE_DEVMAP=y CONFIG_ARCH_HAS_ZONE_DMA_SET=y # CONFIG_ZONE_DMA is not set CONFIG_ZONE_DMA32=y CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y CONFIG_ARCH_HAS_PKEYS=y # CONFIG_VM_EVENT_COUNTERS is not set # CONFIG_PERCPU_STATS is not set # CONFIG_GUP_TEST is not set # CONFIG_DMAPOOL_TEST is not set CONFIG_ARCH_HAS_PTE_SPECIAL=y CONFIG_MEMFD_CREATE=y CONFIG_SECRETMEM=y CONFIG_ANON_VMA_NAME=y # CONFIG_USERFAULTFD is not set CONFIG_LRU_GEN=y CONFIG_LRU_GEN_ENABLED=y CONFIG_LRU_GEN_STATS=y CONFIG_LRU_GEN_WALKS_MMU=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y CONFIG_EXECMEM=y # # Data Access Monitoring # CONFIG_DAMON=y # CONFIG_DAMON_KUNIT_TEST is not set CONFIG_DAMON_VADDR=y # CONFIG_DAMON_PADDR is not set # CONFIG_DAMON_VADDR_KUNIT_TEST is not set CONFIG_DAMON_SYSFS=y # CONFIG_DAMON_SYSFS_KUNIT_TEST is not set # end of Data Access Monitoring # end of Memory Management options CONFIG_NET=y CONFIG_NET_INGRESS=y CONFIG_NET_EGRESS=y CONFIG_NET_XGRESS=y # # Networking options # CONFIG_PACKET=y # CONFIG_PACKET_DIAG is not set CONFIG_UNIX=y CONFIG_AF_UNIX_OOB=y # CONFIG_UNIX_DIAG is not set # CONFIG_TLS is not set # CONFIG_XFRM_USER is not set # CONFIG_NET_KEY is not set # CONFIG_XDP_SOCKETS is not set # CONFIG_NET_HANDSHAKE_KUNIT_TEST is not set CONFIG_INET=y # CONFIG_IP_MULTICAST is not set # CONFIG_IP_ADVANCED_ROUTER is not set # CONFIG_IP_PNP is not set # CONFIG_NET_IPIP is not set # CONFIG_NET_IPGRE_DEMUX is not set # CONFIG_SYN_COOKIES is not set # CONFIG_NET_IPVTI is not set # CONFIG_NET_FOU is not set # CONFIG_INET_AH is not set # CONFIG_INET_ESP is not set # CONFIG_INET_IPCOMP is not set CONFIG_INET_TABLE_PERTURB_ORDER=16 CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y # CONFIG_INET_UDP_DIAG is not set # CONFIG_INET_RAW_DIAG is not set # CONFIG_INET_DIAG_DESTROY is not set # CONFIG_TCP_CONG_ADVANCED is not set CONFIG_TCP_CONG_CUBIC=y CONFIG_DEFAULT_TCP_CONG="cubic" # CONFIG_TCP_AO is not set # CONFIG_TCP_MD5SIG is not set # CONFIG_IPV6 is not set # CONFIG_MPTCP is not set # CONFIG_NETWORK_SECMARK is not set # CONFIG_NETWORK_PHY_TIMESTAMPING is not set CONFIG_NETFILTER=y CONFIG_NETFILTER_ADVANCED=y # # Core Netfilter Configuration # CONFIG_NETFILTER_INGRESS=y CONFIG_NETFILTER_EGRESS=y CONFIG_NETFILTER_NETLINK=y CONFIG_NETFILTER_BPF_LINK=y # CONFIG_NETFILTER_NETLINK_ACCT is not set # CONFIG_NETFILTER_NETLINK_QUEUE is not set # CONFIG_NETFILTER_NETLINK_LOG is not set # CONFIG_NETFILTER_NETLINK_OSF is not set # CONFIG_NF_CONNTRACK is not set # CONFIG_NF_LOG_SYSLOG is not set # CONFIG_NF_TABLES is not set # CONFIG_NETFILTER_XTABLES is not set # end of Core Netfilter Configuration CONFIG_IP_SET=y CONFIG_IP_SET_MAX=256 # CONFIG_IP_SET_BITMAP_IP is not set # CONFIG_IP_SET_BITMAP_IPMAC is not set # CONFIG_IP_SET_BITMAP_PORT is not set # CONFIG_IP_SET_HASH_IP is not set # CONFIG_IP_SET_HASH_IPMARK is not set # CONFIG_IP_SET_HASH_IPPORT is not set # CONFIG_IP_SET_HASH_IPPORTIP is not set # CONFIG_IP_SET_HASH_IPPORTNET is not set # CONFIG_IP_SET_HASH_IPMAC is not set # CONFIG_IP_SET_HASH_MAC is not set # CONFIG_IP_SET_HASH_NETPORTNET is not set # CONFIG_IP_SET_HASH_NET is not set # CONFIG_IP_SET_HASH_NETNET is not set # CONFIG_IP_SET_HASH_NETPORT is not set # CONFIG_IP_SET_HASH_NETIFACE is not set # CONFIG_IP_SET_LIST_SET is not set # CONFIG_IP_VS is not set # # IP: Netfilter Configuration # # CONFIG_NF_SOCKET_IPV4 is not set # CONFIG_NF_TPROXY_IPV4 is not set # CONFIG_NF_DUP_IPV4 is not set # CONFIG_NF_LOG_ARP is not set # CONFIG_NF_LOG_IPV4 is not set # CONFIG_NF_REJECT_IPV4 is not set # CONFIG_IP_NF_IPTABLES is not set # end of IP: Netfilter Configuration # CONFIG_IP_DCCP is not set # CONFIG_IP_SCTP is not set # CONFIG_RDS is not set # CONFIG_TIPC is not set # CONFIG_ATM is not set # CONFIG_L2TP is not set # CONFIG_BRIDGE is not set # CONFIG_NET_DSA is not set # CONFIG_VLAN_8021Q is not set # CONFIG_LLC2 is not set # CONFIG_ATALK is not set # CONFIG_X25 is not set # CONFIG_LAPB is not set # CONFIG_PHONET is not set # CONFIG_IEEE802154 is not set # CONFIG_NET_SCHED is not set # CONFIG_DCB is not set CONFIG_DNS_RESOLVER=y # CONFIG_BATMAN_ADV is not set # CONFIG_OPENVSWITCH is not set # CONFIG_VSOCKETS is not set CONFIG_NETLINK_DIAG=y # CONFIG_MPLS is not set # CONFIG_NET_NSH is not set # CONFIG_HSR is not set # CONFIG_NET_SWITCHDEV is not set # CONFIG_NET_L3_MASTER_DEV is not set # CONFIG_QRTR is not set # CONFIG_NET_NCSI is not set CONFIG_PCPU_DEV_REFCNT=y CONFIG_MAX_SKB_FRAGS=17 CONFIG_RPS=y CONFIG_RFS_ACCEL=y CONFIG_SOCK_RX_QUEUE_MAPPING=y CONFIG_XPS=y CONFIG_CGROUP_NET_PRIO=y CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_STREAM_PARSER=y CONFIG_NET_FLOW_LIMIT=y # # Network testing # # CONFIG_NET_PKTGEN is not set # CONFIG_NET_DROP_MONITOR is not set # end of Network testing # end of Networking options # CONFIG_HAMRADIO is not set # CONFIG_CAN is not set # CONFIG_BT is not set # CONFIG_AF_RXRPC is not set # CONFIG_AF_KCM is not set CONFIG_STREAM_PARSER=y # CONFIG_MCTP is not set CONFIG_WIRELESS=y # CONFIG_CFG80211 is not set # # CFG80211 needs to be enabled for MAC80211 # CONFIG_MAC80211_STA_HASH_MAX_SIZE=0 # CONFIG_RFKILL is not set CONFIG_NET_9P=y CONFIG_NET_9P_FD=y CONFIG_NET_9P_VIRTIO=y # CONFIG_NET_9P_DEBUG is not set # CONFIG_CAIF is not set # CONFIG_CEPH_LIB is not set # CONFIG_NFC is not set # CONFIG_PSAMPLE is not set # CONFIG_NET_IFE is not set CONFIG_LWTUNNEL=y CONFIG_LWTUNNEL_BPF=y CONFIG_NET_SOCK_MSG=y CONFIG_PAGE_POOL=y CONFIG_PAGE_POOL_STATS=y CONFIG_FAILOVER=y CONFIG_ETHTOOL_NETLINK=y # CONFIG_NETDEV_ADDR_LIST_TEST is not set # CONFIG_NET_TEST is not set # # Device Drivers # CONFIG_HAVE_EISA=y # CONFIG_EISA is not set CONFIG_HAVE_PCI=y CONFIG_GENERIC_PCI_IOMAP=y CONFIG_PCI=y CONFIG_PCI_DOMAINS=y # CONFIG_PCIEPORTBUS is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEFAULT=y # CONFIG_PCIEASPM_POWERSAVE is not set # CONFIG_PCIEASPM_POWER_SUPERSAVE is not set # CONFIG_PCIEASPM_PERFORMANCE is not set # CONFIG_PCIE_PTM is not set CONFIG_PCI_MSI=y CONFIG_PCI_QUIRKS=y # CONFIG_PCI_DEBUG is not set # CONFIG_PCI_STUB is not set CONFIG_PCI_ATS=y CONFIG_PCI_LOCKLESS_CONFIG=y # CONFIG_PCI_IOV is not set CONFIG_PCI_PRI=y CONFIG_PCI_PASID=y CONFIG_PCI_LABEL=y # CONFIG_PCIE_BUS_TUNE_OFF is not set CONFIG_PCIE_BUS_DEFAULT=y # CONFIG_PCIE_BUS_SAFE is not set # CONFIG_PCIE_BUS_PERFORMANCE is not set # CONFIG_PCIE_BUS_PEER2PEER is not set CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 # CONFIG_HOTPLUG_PCI is not set # # PCI controller drivers # # CONFIG_VMD is not set # # Cadence-based PCIe controllers # # end of Cadence-based PCIe controllers # # DesignWare-based PCIe controllers # # CONFIG_PCI_MESON is not set # CONFIG_PCIE_DW_PLAT_HOST is not set # end of DesignWare-based PCIe controllers # # Mobiveil-based PCIe controllers # # end of Mobiveil-based PCIe controllers # end of PCI controller drivers # # PCI Endpoint # # CONFIG_PCI_ENDPOINT is not set # end of PCI Endpoint # # PCI switch controller drivers # # CONFIG_PCI_SW_SWITCHTEC is not set # end of PCI switch controller drivers # CONFIG_CXL_BUS is not set # CONFIG_PCCARD is not set # CONFIG_RAPIDIO is not set # # Generic Driver Options # # CONFIG_UEVENT_HELPER is not set CONFIG_DEVTMPFS=y CONFIG_DEVTMPFS_MOUNT=y # CONFIG_DEVTMPFS_SAFE is not set # CONFIG_STANDALONE is not set # CONFIG_PREVENT_FIRMWARE_BUILD is not set # # Firmware loader # CONFIG_FW_LOADER=y CONFIG_FW_LOADER_DEBUG=y CONFIG_EXTRA_FIRMWARE="" # CONFIG_FW_LOADER_USER_HELPER is not set # CONFIG_FW_LOADER_COMPRESS is not set # CONFIG_FW_UPLOAD is not set # end of Firmware loader # CONFIG_ALLOW_DEV_COREDUMP is not set # CONFIG_DEBUG_DRIVER is not set # CONFIG_DEBUG_DEVRES is not set # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set # CONFIG_PM_QOS_KUNIT_TEST is not set # CONFIG_TEST_ASYNC_DRIVER_PROBE is not set # CONFIG_DM_KUNIT_TEST is not set # CONFIG_DRIVER_PE_KUNIT_TEST is not set CONFIG_GENERIC_CPU_DEVICES=y CONFIG_GENERIC_CPU_AUTOPROBE=y CONFIG_GENERIC_CPU_VULNERABILITIES=y # CONFIG_REGMAP_BUILD is not set CONFIG_DMA_SHARED_BUFFER=y # CONFIG_DMA_FENCE_TRACE is not set # CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set # end of Generic Driver Options # # Bus devices # # CONFIG_MHI_BUS is not set # CONFIG_MHI_BUS_EP is not set # end of Bus devices # # Cache Drivers # # end of Cache Drivers CONFIG_CONNECTOR=y CONFIG_PROC_EVENTS=y # # Firmware Drivers # # # ARM System Control and Management Interface Protocol # # end of ARM System Control and Management Interface Protocol # CONFIG_EDD is not set # CONFIG_FIRMWARE_MEMMAP is not set CONFIG_DMIID=y # CONFIG_DMI_SYSFS is not set CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y # CONFIG_ISCSI_IBFT is not set # CONFIG_FW_CFG_SYSFS is not set # CONFIG_SYSFB_SIMPLEFB is not set # CONFIG_GOOGLE_FIRMWARE is not set # # EFI (Extensible Firmware Interface) Support # CONFIG_EFI_ESRT=y CONFIG_EFI_VARS_PSTORE=y # CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE is not set CONFIG_EFI_DXE_MEM_ATTRIBUTES=y CONFIG_EFI_RUNTIME_WRAPPERS=y # CONFIG_EFI_BOOTLOADER_CONTROL is not set # CONFIG_EFI_CAPSULE_LOADER is not set # CONFIG_EFI_TEST is not set # CONFIG_APPLE_PROPERTIES is not set # CONFIG_RESET_ATTACK_MITIGATION is not set # CONFIG_EFI_RCI2_TABLE is not set # CONFIG_EFI_DISABLE_PCI_DMA is not set CONFIG_EFI_EARLYCON=y # CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set # CONFIG_EFI_DISABLE_RUNTIME is not set CONFIG_EFI_COCO_SECRET=y # end of EFI (Extensible Firmware Interface) Support CONFIG_UEFI_CPER=y CONFIG_UEFI_CPER_X86=y # # Qualcomm firmware drivers # # end of Qualcomm firmware drivers # # Tegra firmware driver # # end of Tegra firmware driver # end of Firmware Drivers # CONFIG_GNSS is not set # CONFIG_MTD is not set # CONFIG_OF is not set CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y # CONFIG_PARPORT is not set CONFIG_PNP=y CONFIG_PNP_DEBUG_MESSAGES=y # # Protocols # CONFIG_PNPACPI=y CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_NULL_BLK is not set # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 # CONFIG_BLK_DEV_DRBD is not set # CONFIG_BLK_DEV_NBD is not set # CONFIG_BLK_DEV_RAM is not set # CONFIG_CDROM_PKTCDVD is not set # CONFIG_ATA_OVER_ETH is not set CONFIG_VIRTIO_BLK=y # CONFIG_BLK_DEV_RBD is not set # CONFIG_BLK_DEV_UBLK is not set # # NVME Support # # CONFIG_BLK_DEV_NVME is not set # CONFIG_NVME_FC is not set # CONFIG_NVME_TCP is not set # end of NVME Support # # Misc devices # # CONFIG_AD525X_DPOT is not set # CONFIG_DUMMY_IRQ is not set # CONFIG_IBM_ASM is not set # CONFIG_PHANTOM is not set # CONFIG_TIFM_CORE is not set # CONFIG_ICS932S401 is not set # CONFIG_ENCLOSURE_SERVICES is not set # CONFIG_HP_ILO is not set # CONFIG_APDS9802ALS is not set # CONFIG_ISL29003 is not set # CONFIG_ISL29020 is not set # CONFIG_SENSORS_TSL2550 is not set # CONFIG_SENSORS_BH1770 is not set # CONFIG_SENSORS_APDS990X is not set # CONFIG_HMC6352 is not set # CONFIG_DS1682 is not set # CONFIG_SRAM is not set # CONFIG_DW_XDATA_PCIE is not set # CONFIG_PCI_ENDPOINT_TEST is not set # CONFIG_XILINX_SDFEC is not set # CONFIG_NSM is not set # CONFIG_C2PORT is not set # # EEPROM support # # CONFIG_EEPROM_AT24 is not set # CONFIG_EEPROM_MAX6875 is not set # CONFIG_EEPROM_93CX6 is not set # CONFIG_EEPROM_IDT_89HPESX is not set # CONFIG_EEPROM_EE1004 is not set # end of EEPROM support # CONFIG_CB710_CORE is not set # # Texas Instruments shared transport line discipline # # end of Texas Instruments shared transport line discipline # CONFIG_SENSORS_LIS3_I2C is not set # CONFIG_ALTERA_STAPL is not set # CONFIG_INTEL_MEI is not set # CONFIG_VMWARE_VMCI is not set # CONFIG_GENWQE is not set # CONFIG_ECHO is not set # CONFIG_BCM_VK is not set # CONFIG_MISC_ALCOR_PCI is not set # CONFIG_MISC_RTSX_PCI is not set CONFIG_PVPANIC=y # CONFIG_PVPANIC_MMIO is not set # CONFIG_PVPANIC_PCI is not set # end of Misc devices # # SCSI device support # CONFIG_SCSI_MOD=y # CONFIG_RAID_ATTRS is not set CONFIG_SCSI_COMMON=y CONFIG_SCSI=y CONFIG_SCSI_DMA=y CONFIG_SCSI_PROC_FS=y # CONFIG_SCSI_LIB_KUNIT_TEST is not set # # SCSI support type (disk, tape, CD-ROM) # CONFIG_BLK_DEV_SD=y # CONFIG_CHR_DEV_ST is not set # CONFIG_BLK_DEV_SR is not set # CONFIG_CHR_DEV_SG is not set CONFIG_BLK_DEV_BSG=y # CONFIG_CHR_DEV_SCH is not set # CONFIG_SCSI_CONSTANTS is not set # CONFIG_SCSI_LOGGING is not set # CONFIG_SCSI_SCAN_ASYNC is not set # CONFIG_SCSI_PROTO_TEST is not set # # SCSI Transports # # CONFIG_SCSI_SPI_ATTRS is not set # CONFIG_SCSI_FC_ATTRS is not set # CONFIG_SCSI_ISCSI_ATTRS is not set # CONFIG_SCSI_SAS_ATTRS is not set # CONFIG_SCSI_SAS_LIBSAS is not set # CONFIG_SCSI_SRP_ATTRS is not set # end of SCSI Transports CONFIG_SCSI_LOWLEVEL=y # CONFIG_ISCSI_TCP is not set # CONFIG_ISCSI_BOOT_SYSFS is not set # CONFIG_SCSI_CXGB3_ISCSI is not set # CONFIG_SCSI_CXGB4_ISCSI is not set # CONFIG_SCSI_BNX2_ISCSI is not set # CONFIG_BE2ISCSI is not set # CONFIG_BLK_DEV_3W_XXXX_RAID is not set # CONFIG_SCSI_HPSA is not set # CONFIG_SCSI_3W_9XXX is not set # CONFIG_SCSI_3W_SAS is not set # CONFIG_SCSI_ACARD is not set # CONFIG_SCSI_AACRAID is not set # CONFIG_SCSI_AIC7XXX is not set # CONFIG_SCSI_AIC79XX is not set # CONFIG_SCSI_AIC94XX is not set # CONFIG_SCSI_MVSAS is not set # CONFIG_SCSI_MVUMI is not set # CONFIG_SCSI_ADVANSYS is not set # CONFIG_SCSI_ARCMSR is not set # CONFIG_SCSI_ESAS2R is not set # CONFIG_MEGARAID_NEWGEN is not set # CONFIG_MEGARAID_LEGACY is not set # CONFIG_MEGARAID_SAS is not set # CONFIG_SCSI_MPT3SAS is not set # CONFIG_SCSI_MPT2SAS is not set # CONFIG_SCSI_MPI3MR is not set # CONFIG_SCSI_SMARTPQI is not set # CONFIG_SCSI_HPTIOP is not set # CONFIG_SCSI_BUSLOGIC is not set # CONFIG_SCSI_MYRB is not set # CONFIG_SCSI_MYRS is not set # CONFIG_VMWARE_PVSCSI is not set # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set # CONFIG_SCSI_FDOMAIN_PCI is not set # CONFIG_SCSI_ISCI is not set # CONFIG_SCSI_IPS is not set # CONFIG_SCSI_INITIO is not set # CONFIG_SCSI_INIA100 is not set # CONFIG_SCSI_STEX is not set # CONFIG_SCSI_SYM53C8XX_2 is not set # CONFIG_SCSI_IPR is not set # CONFIG_SCSI_QLOGIC_1280 is not set # CONFIG_SCSI_QLA_ISCSI is not set # CONFIG_SCSI_DC395x is not set # CONFIG_SCSI_AM53C974 is not set # CONFIG_SCSI_WD719X is not set # CONFIG_SCSI_DEBUG is not set # CONFIG_SCSI_PMCRAID is not set # CONFIG_SCSI_PM8001 is not set CONFIG_SCSI_VIRTIO=y # CONFIG_SCSI_DH is not set # end of SCSI device support CONFIG_ATA=y CONFIG_SATA_HOST=y CONFIG_PATA_TIMINGS=y CONFIG_ATA_VERBOSE_ERROR=y CONFIG_ATA_FORCE=y CONFIG_ATA_ACPI=y CONFIG_SATA_PMP=y # # Controllers with non-SFF native interface # CONFIG_SATA_AHCI=y CONFIG_SATA_MOBILE_LPM_POLICY=0 # CONFIG_SATA_AHCI_PLATFORM is not set # CONFIG_AHCI_DWC is not set # CONFIG_SATA_INIC162X is not set # CONFIG_SATA_ACARD_AHCI is not set # CONFIG_SATA_SIL24 is not set CONFIG_ATA_SFF=y # # SFF controllers with custom DMA interface # # CONFIG_PDC_ADMA is not set # CONFIG_SATA_QSTOR is not set # CONFIG_SATA_SX4 is not set CONFIG_ATA_BMDMA=y # # SATA SFF controllers with BMDMA # CONFIG_ATA_PIIX=y # CONFIG_SATA_MV is not set # CONFIG_SATA_NV is not set # CONFIG_SATA_PROMISE is not set # CONFIG_SATA_SIL is not set # CONFIG_SATA_SIS is not set # CONFIG_SATA_SVW is not set # CONFIG_SATA_ULI is not set # CONFIG_SATA_VIA is not set # CONFIG_SATA_VITESSE is not set # # PATA SFF controllers with BMDMA # # CONFIG_PATA_ALI is not set # CONFIG_PATA_AMD is not set # CONFIG_PATA_ARTOP is not set # CONFIG_PATA_ATIIXP is not set # CONFIG_PATA_ATP867X is not set # CONFIG_PATA_CMD64X is not set # CONFIG_PATA_CYPRESS is not set # CONFIG_PATA_EFAR is not set # CONFIG_PATA_HPT366 is not set # CONFIG_PATA_HPT37X is not set # CONFIG_PATA_HPT3X2N is not set # CONFIG_PATA_HPT3X3 is not set # CONFIG_PATA_IT8213 is not set # CONFIG_PATA_IT821X is not set # CONFIG_PATA_JMICRON is not set # CONFIG_PATA_MARVELL is not set # CONFIG_PATA_NETCELL is not set # CONFIG_PATA_NINJA32 is not set # CONFIG_PATA_NS87415 is not set # CONFIG_PATA_OLDPIIX is not set # CONFIG_PATA_OPTIDMA is not set # CONFIG_PATA_PDC2027X is not set # CONFIG_PATA_PDC_OLD is not set # CONFIG_PATA_RADISYS is not set # CONFIG_PATA_RDC is not set # CONFIG_PATA_SCH is not set # CONFIG_PATA_SERVERWORKS is not set # CONFIG_PATA_SIL680 is not set # CONFIG_PATA_SIS is not set # CONFIG_PATA_TOSHIBA is not set # CONFIG_PATA_TRIFLEX is not set # CONFIG_PATA_VIA is not set # CONFIG_PATA_WINBOND is not set # # PIO-only SFF controllers # # CONFIG_PATA_CMD640_PCI is not set # CONFIG_PATA_MPIIX is not set # CONFIG_PATA_NS87410 is not set # CONFIG_PATA_OPTI is not set # CONFIG_PATA_RZ1000 is not set # # Generic fallback / legacy drivers # # CONFIG_PATA_ACPI is not set # CONFIG_ATA_GENERIC is not set # CONFIG_PATA_LEGACY is not set # CONFIG_MD is not set # CONFIG_TARGET_CORE is not set # CONFIG_FUSION is not set # # IEEE 1394 (FireWire) support # # CONFIG_FIREWIRE is not set # CONFIG_FIREWIRE_NOSY is not set # end of IEEE 1394 (FireWire) support # CONFIG_MACINTOSH_DRIVERS is not set CONFIG_NETDEVICES=y CONFIG_NET_CORE=y # CONFIG_BONDING is not set # CONFIG_DUMMY is not set # CONFIG_WIREGUARD is not set # CONFIG_EQUALIZER is not set # CONFIG_NET_FC is not set # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set # CONFIG_IPVLAN is not set # CONFIG_VXLAN is not set # CONFIG_GENEVE is not set # CONFIG_BAREUDP is not set # CONFIG_GTP is not set # CONFIG_PFCP is not set # CONFIG_MACSEC is not set # CONFIG_NETCONSOLE is not set # CONFIG_TUN is not set # CONFIG_TUN_VNET_CROSS_LE is not set # CONFIG_VETH is not set CONFIG_VIRTIO_NET=y # CONFIG_NLMON is not set # CONFIG_NETKIT is not set # CONFIG_ARCNET is not set CONFIG_ETHERNET=y # CONFIG_NET_VENDOR_3COM is not set # CONFIG_NET_VENDOR_ADAPTEC is not set # CONFIG_NET_VENDOR_AGERE is not set # CONFIG_NET_VENDOR_ALACRITECH is not set # CONFIG_NET_VENDOR_ALTEON is not set # CONFIG_ALTERA_TSE is not set # CONFIG_NET_VENDOR_AMAZON is not set # CONFIG_NET_VENDOR_AMD is not set # CONFIG_NET_VENDOR_AQUANTIA is not set # CONFIG_NET_VENDOR_ARC is not set # CONFIG_NET_VENDOR_ASIX is not set # CONFIG_NET_VENDOR_ATHEROS is not set # CONFIG_CX_ECAT is not set # CONFIG_NET_VENDOR_BROADCOM is not set # CONFIG_NET_VENDOR_CADENCE is not set # CONFIG_NET_VENDOR_CAVIUM is not set # CONFIG_NET_VENDOR_CHELSIO is not set # CONFIG_NET_VENDOR_CISCO is not set # CONFIG_NET_VENDOR_CORTINA is not set # CONFIG_NET_VENDOR_DAVICOM is not set # CONFIG_DNET is not set # CONFIG_NET_VENDOR_DEC is not set # CONFIG_NET_VENDOR_DLINK is not set # CONFIG_NET_VENDOR_EMULEX is not set # CONFIG_NET_VENDOR_ENGLEDER is not set # CONFIG_NET_VENDOR_EZCHIP is not set # CONFIG_NET_VENDOR_FUNGIBLE is not set # CONFIG_NET_VENDOR_GOOGLE is not set # CONFIG_NET_VENDOR_HUAWEI is not set # CONFIG_NET_VENDOR_I825XX is not set CONFIG_NET_VENDOR_INTEL=y # CONFIG_E100 is not set # CONFIG_E1000 is not set # CONFIG_E1000E is not set # CONFIG_IGB is not set # CONFIG_IGBVF is not set # CONFIG_IXGBE is not set # CONFIG_IXGBEVF is not set # CONFIG_I40E is not set # CONFIG_I40EVF is not set # CONFIG_ICE is not set # CONFIG_FM10K is not set CONFIG_IGC=y # CONFIG_IDPF is not set # CONFIG_JME is not set # CONFIG_NET_VENDOR_LITEX is not set # CONFIG_NET_VENDOR_MARVELL is not set # CONFIG_NET_VENDOR_MELLANOX is not set # CONFIG_NET_VENDOR_MICREL is not set # CONFIG_NET_VENDOR_MICROCHIP is not set # CONFIG_NET_VENDOR_MICROSEMI is not set # CONFIG_NET_VENDOR_MICROSOFT is not set # CONFIG_NET_VENDOR_MYRI is not set # CONFIG_FEALNX is not set # CONFIG_NET_VENDOR_NI is not set # CONFIG_NET_VENDOR_NATSEMI is not set # CONFIG_NET_VENDOR_NETERION is not set # CONFIG_NET_VENDOR_NETRONOME is not set # CONFIG_NET_VENDOR_NVIDIA is not set # CONFIG_NET_VENDOR_OKI is not set # CONFIG_ETHOC is not set # CONFIG_NET_VENDOR_PACKET_ENGINES is not set # CONFIG_NET_VENDOR_PENSANDO is not set # CONFIG_NET_VENDOR_QLOGIC is not set # CONFIG_NET_VENDOR_BROCADE is not set # CONFIG_NET_VENDOR_QUALCOMM is not set # CONFIG_NET_VENDOR_RDC is not set # CONFIG_NET_VENDOR_REALTEK is not set # CONFIG_NET_VENDOR_RENESAS is not set # CONFIG_NET_VENDOR_ROCKER is not set # CONFIG_NET_VENDOR_SAMSUNG is not set # CONFIG_NET_VENDOR_SEEQ is not set # CONFIG_NET_VENDOR_SILAN is not set # CONFIG_NET_VENDOR_SIS is not set # CONFIG_NET_VENDOR_SOLARFLARE is not set # CONFIG_NET_VENDOR_SMSC is not set # CONFIG_NET_VENDOR_SOCIONEXT is not set # CONFIG_NET_VENDOR_STMICRO is not set # CONFIG_NET_VENDOR_SUN is not set # CONFIG_NET_VENDOR_SYNOPSYS is not set # CONFIG_NET_VENDOR_TEHUTI is not set # CONFIG_NET_VENDOR_TI is not set # CONFIG_NET_VENDOR_VERTEXCOM is not set # CONFIG_NET_VENDOR_VIA is not set # CONFIG_NET_VENDOR_WANGXUN is not set # CONFIG_NET_VENDOR_WIZNET is not set # CONFIG_NET_VENDOR_XILINX is not set # CONFIG_FDDI is not set # CONFIG_HIPPI is not set # CONFIG_PHYLIB is not set # CONFIG_MDIO_DEVICE is not set # # PCS device drivers # # end of PCS device drivers # CONFIG_PPP is not set # CONFIG_SLIP is not set # # Host-side USB support is needed for USB Network Adapter support # # CONFIG_WLAN is not set # CONFIG_WAN is not set # # Wireless WAN # # CONFIG_WWAN is not set # end of Wireless WAN # CONFIG_VMXNET3 is not set # CONFIG_FUJITSU_ES is not set # CONFIG_NETDEVSIM is not set CONFIG_NET_FAILOVER=y # CONFIG_ISDN is not set # # Input device support # CONFIG_INPUT=y # CONFIG_INPUT_FF_MEMLESS is not set # CONFIG_INPUT_SPARSEKMAP is not set # CONFIG_INPUT_MATRIXKMAP is not set CONFIG_INPUT_VIVALDIFMAP=y # # Userland interfaces # # CONFIG_INPUT_MOUSEDEV is not set # CONFIG_INPUT_JOYDEV is not set # CONFIG_INPUT_EVDEV is not set # CONFIG_INPUT_EVBUG is not set # CONFIG_INPUT_KUNIT_TEST is not set # # Input Device Drivers # CONFIG_INPUT_KEYBOARD=y # CONFIG_KEYBOARD_ADP5588 is not set # CONFIG_KEYBOARD_ADP5589 is not set CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_QT1050 is not set # CONFIG_KEYBOARD_QT1070 is not set # CONFIG_KEYBOARD_QT2160 is not set # CONFIG_KEYBOARD_DLINK_DIR685 is not set # CONFIG_KEYBOARD_LKKBD is not set # CONFIG_KEYBOARD_TCA6416 is not set # CONFIG_KEYBOARD_TCA8418 is not set # CONFIG_KEYBOARD_LM8333 is not set # CONFIG_KEYBOARD_MAX7359 is not set # CONFIG_KEYBOARD_MCS is not set # CONFIG_KEYBOARD_MPR121 is not set # CONFIG_KEYBOARD_NEWTON is not set # CONFIG_KEYBOARD_OPENCORES is not set # CONFIG_KEYBOARD_SAMSUNG is not set # CONFIG_KEYBOARD_STOWAWAY is not set # CONFIG_KEYBOARD_SUNKBD is not set # CONFIG_KEYBOARD_XTKBD is not set # CONFIG_KEYBOARD_CYPRESS_SF is not set CONFIG_INPUT_MOUSE=y CONFIG_MOUSE_PS2=y CONFIG_MOUSE_PS2_ALPS=y CONFIG_MOUSE_PS2_BYD=y CONFIG_MOUSE_PS2_LOGIPS2PP=y CONFIG_MOUSE_PS2_SYNAPTICS=y CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS=y CONFIG_MOUSE_PS2_CYPRESS=y CONFIG_MOUSE_PS2_LIFEBOOK=y CONFIG_MOUSE_PS2_TRACKPOINT=y # CONFIG_MOUSE_PS2_ELANTECH is not set # CONFIG_MOUSE_PS2_SENTELIC is not set # CONFIG_MOUSE_PS2_TOUCHKIT is not set CONFIG_MOUSE_PS2_FOCALTECH=y # CONFIG_MOUSE_PS2_VMMOUSE is not set CONFIG_MOUSE_PS2_SMBUS=y # CONFIG_MOUSE_SERIAL is not set # CONFIG_MOUSE_CYAPA is not set # CONFIG_MOUSE_ELAN_I2C is not set # CONFIG_MOUSE_VSXXXAA is not set # CONFIG_MOUSE_SYNAPTICS_I2C is not set # CONFIG_INPUT_JOYSTICK is not set # CONFIG_INPUT_TABLET is not set # CONFIG_INPUT_TOUCHSCREEN is not set # CONFIG_INPUT_MISC is not set # CONFIG_RMI4_CORE is not set # # Hardware I/O ports # CONFIG_SERIO=y CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y CONFIG_SERIO_I8042=y CONFIG_SERIO_SERPORT=y # CONFIG_SERIO_CT82C710 is not set # CONFIG_SERIO_PCIPS2 is not set CONFIG_SERIO_LIBPS2=y # CONFIG_SERIO_RAW is not set # CONFIG_SERIO_ALTERA_PS2 is not set # CONFIG_SERIO_PS2MULT is not set # CONFIG_SERIO_ARC_PS2 is not set # CONFIG_USERIO is not set # CONFIG_GAMEPORT is not set # end of Hardware I/O ports # end of Input device support # # Character devices # CONFIG_TTY=y CONFIG_VT=y CONFIG_CONSOLE_TRANSLATIONS=y CONFIG_VT_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y CONFIG_LEGACY_PTYS=y CONFIG_LEGACY_PTY_COUNT=256 CONFIG_LEGACY_TIOCSTI=y CONFIG_LDISC_AUTOLOAD=y # # Serial drivers # CONFIG_SERIAL_EARLYCON=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y CONFIG_SERIAL_8250_PNP=y # CONFIG_SERIAL_8250_16550A_VARIANTS is not set # CONFIG_SERIAL_8250_FINTEK is not set CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_8250_PCILIB=y CONFIG_SERIAL_8250_PCI=y CONFIG_SERIAL_8250_EXAR=y CONFIG_SERIAL_8250_NR_UARTS=4 CONFIG_SERIAL_8250_RUNTIME_UARTS=4 # CONFIG_SERIAL_8250_EXTENDED is not set # CONFIG_SERIAL_8250_PCI1XXXX is not set CONFIG_SERIAL_8250_DWLIB=y # CONFIG_SERIAL_8250_DW is not set # CONFIG_SERIAL_8250_RT288X is not set CONFIG_SERIAL_8250_LPSS=y CONFIG_SERIAL_8250_MID=y CONFIG_SERIAL_8250_PERICOM=y # # Non-8250 serial port support # # CONFIG_SERIAL_UARTLITE is not set CONFIG_SERIAL_CORE=y CONFIG_SERIAL_CORE_CONSOLE=y # CONFIG_SERIAL_JSM is not set # CONFIG_SERIAL_LANTIQ is not set # CONFIG_SERIAL_SCCNXP is not set # CONFIG_SERIAL_SC16IS7XX is not set # CONFIG_SERIAL_ALTERA_JTAGUART is not set # CONFIG_SERIAL_ALTERA_UART is not set # CONFIG_SERIAL_ARC is not set # CONFIG_SERIAL_RP2 is not set # CONFIG_SERIAL_FSL_LPUART is not set # CONFIG_SERIAL_FSL_LINFLEXUART is not set # CONFIG_SERIAL_SPRD is not set # end of Serial drivers # CONFIG_SERIAL_NONSTANDARD is not set # CONFIG_N_GSM is not set # CONFIG_NOZOMI is not set # CONFIG_NULL_TTY is not set # CONFIG_SERIAL_DEV_BUS is not set # CONFIG_TTY_PRINTK is not set # CONFIG_VIRTIO_CONSOLE is not set # CONFIG_IPMI_HANDLER is not set # CONFIG_HW_RANDOM is not set # CONFIG_APPLICOM is not set # CONFIG_MWAVE is not set # CONFIG_DEVMEM is not set CONFIG_NVRAM=y # CONFIG_DEVPORT is not set CONFIG_HPET=y CONFIG_HPET_MMAP=y CONFIG_HPET_MMAP_DEFAULT=y # CONFIG_HANGCHECK_TIMER is not set CONFIG_TCG_TPM=y CONFIG_TCG_TPM2_HMAC=y CONFIG_TCG_TIS_CORE=y CONFIG_TCG_TIS=y CONFIG_TCG_TIS_I2C=y # CONFIG_TCG_TIS_I2C_CR50 is not set # CONFIG_TCG_TIS_I2C_ATMEL is not set # CONFIG_TCG_TIS_I2C_INFINEON is not set # CONFIG_TCG_TIS_I2C_NUVOTON is not set # CONFIG_TCG_NSC is not set # CONFIG_TCG_ATMEL is not set # CONFIG_TCG_INFINEON is not set CONFIG_TCG_CRB=y # CONFIG_TCG_VTPM_PROXY is not set # CONFIG_TCG_TIS_ST33ZP24_I2C is not set # CONFIG_TELCLOCK is not set # CONFIG_XILLYBUS is not set # end of Character devices # # I2C support # CONFIG_I2C=y CONFIG_ACPI_I2C_OPREGION=y CONFIG_I2C_BOARDINFO=y CONFIG_I2C_COMPAT=y # CONFIG_I2C_CHARDEV is not set # CONFIG_I2C_MUX is not set CONFIG_I2C_HELPER_AUTO=y # # I2C Hardware Bus support # # # PC SMBus host controller drivers # # CONFIG_I2C_ALI1535 is not set # CONFIG_I2C_ALI1563 is not set # CONFIG_I2C_ALI15X3 is not set # CONFIG_I2C_AMD756 is not set # CONFIG_I2C_AMD8111 is not set # CONFIG_I2C_AMD_MP2 is not set # CONFIG_I2C_I801 is not set # CONFIG_I2C_ISCH is not set # CONFIG_I2C_ISMT is not set # CONFIG_I2C_PIIX4 is not set # CONFIG_I2C_NFORCE2 is not set # CONFIG_I2C_NVIDIA_GPU is not set # CONFIG_I2C_SIS5595 is not set # CONFIG_I2C_SIS630 is not set # CONFIG_I2C_SIS96X is not set # CONFIG_I2C_VIA is not set # CONFIG_I2C_VIAPRO is not set # CONFIG_I2C_ZHAOXIN is not set # # ACPI drivers # # CONFIG_I2C_SCMI is not set # # I2C system bus drivers (mostly embedded / system-on-chip) # # CONFIG_I2C_DESIGNWARE_PLATFORM is not set # CONFIG_I2C_DESIGNWARE_PCI is not set # CONFIG_I2C_EMEV2 is not set # CONFIG_I2C_OCORES is not set # CONFIG_I2C_PCA_PLATFORM is not set # CONFIG_I2C_SIMTEC is not set # CONFIG_I2C_XILINX is not set # # External I2C/SMBus adapter drivers # # CONFIG_I2C_PCI1XXXX is not set # CONFIG_I2C_TAOS_EVM is not set # # Other I2C/SMBus bus drivers # # CONFIG_I2C_MLXCPLD is not set # CONFIG_I2C_VIRTIO is not set # end of I2C Hardware Bus support # CONFIG_I2C_STUB is not set # CONFIG_I2C_SLAVE is not set # CONFIG_I2C_DEBUG_CORE is not set # CONFIG_I2C_DEBUG_ALGO is not set # CONFIG_I2C_DEBUG_BUS is not set # end of I2C support # CONFIG_I3C is not set # CONFIG_SPI is not set # CONFIG_SPMI is not set # CONFIG_HSI is not set # CONFIG_PPS is not set # # PTP clock support # # CONFIG_PTP_1588_CLOCK is not set CONFIG_PTP_1588_CLOCK_OPTIONAL=y # # Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. # # end of PTP clock support CONFIG_PINCTRL=y # CONFIG_DEBUG_PINCTRL is not set # CONFIG_PINCTRL_AMD is not set # CONFIG_PINCTRL_CY8C95X0 is not set # CONFIG_PINCTRL_MCP23S08 is not set # CONFIG_PINCTRL_SX150X is not set # # Intel pinctrl drivers # # CONFIG_PINCTRL_BAYTRAIL is not set # CONFIG_PINCTRL_CHERRYVIEW is not set # CONFIG_PINCTRL_LYNXPOINT is not set # CONFIG_PINCTRL_INTEL_PLATFORM is not set # CONFIG_PINCTRL_ALDERLAKE is not set # CONFIG_PINCTRL_BROXTON is not set # CONFIG_PINCTRL_CANNONLAKE is not set # CONFIG_PINCTRL_CEDARFORK is not set # CONFIG_PINCTRL_DENVERTON is not set # CONFIG_PINCTRL_ELKHARTLAKE is not set # CONFIG_PINCTRL_EMMITSBURG is not set # CONFIG_PINCTRL_GEMINILAKE is not set # CONFIG_PINCTRL_ICELAKE is not set # CONFIG_PINCTRL_JASPERLAKE is not set # CONFIG_PINCTRL_LAKEFIELD is not set # CONFIG_PINCTRL_LEWISBURG is not set # CONFIG_PINCTRL_METEORLAKE is not set # CONFIG_PINCTRL_METEORPOINT is not set # CONFIG_PINCTRL_SUNRISEPOINT is not set # CONFIG_PINCTRL_TIGERLAKE is not set # end of Intel pinctrl drivers # # Renesas pinctrl drivers # # end of Renesas pinctrl drivers # CONFIG_GPIOLIB is not set # CONFIG_W1 is not set # CONFIG_POWER_RESET is not set CONFIG_POWER_SUPPLY=y # CONFIG_POWER_SUPPLY_DEBUG is not set CONFIG_POWER_SUPPLY_HWMON=y # CONFIG_IP5XXX_POWER is not set # CONFIG_TEST_POWER is not set # CONFIG_CHARGER_ADP5061 is not set # CONFIG_BATTERY_CW2015 is not set # CONFIG_BATTERY_DS2780 is not set # CONFIG_BATTERY_DS2781 is not set # CONFIG_BATTERY_DS2782 is not set # CONFIG_BATTERY_SAMSUNG_SDI is not set # CONFIG_BATTERY_SBS is not set # CONFIG_CHARGER_SBS is not set # CONFIG_BATTERY_BQ27XXX is not set # CONFIG_BATTERY_MAX17042 is not set # CONFIG_CHARGER_MAX8903 is not set # CONFIG_CHARGER_LP8727 is not set # CONFIG_CHARGER_LTC4162L is not set # CONFIG_CHARGER_MAX77976 is not set # CONFIG_CHARGER_BQ2415X is not set # CONFIG_BATTERY_GAUGE_LTC2941 is not set # CONFIG_BATTERY_GOLDFISH is not set # CONFIG_BATTERY_RT5033 is not set # CONFIG_CHARGER_BD99954 is not set # CONFIG_BATTERY_UG3105 is not set # CONFIG_FUEL_GAUGE_MM8013 is not set CONFIG_HWMON=y # CONFIG_HWMON_DEBUG_CHIP is not set # # Native drivers # # CONFIG_SENSORS_ABITUGURU is not set # CONFIG_SENSORS_ABITUGURU3 is not set # CONFIG_SENSORS_AD7414 is not set # CONFIG_SENSORS_AD7418 is not set # CONFIG_SENSORS_ADM1021 is not set # CONFIG_SENSORS_ADM1025 is not set # CONFIG_SENSORS_ADM1026 is not set # CONFIG_SENSORS_ADM1029 is not set # CONFIG_SENSORS_ADM1031 is not set # CONFIG_SENSORS_ADM1177 is not set # CONFIG_SENSORS_ADM9240 is not set # CONFIG_SENSORS_ADT7410 is not set # CONFIG_SENSORS_ADT7411 is not set # CONFIG_SENSORS_ADT7462 is not set # CONFIG_SENSORS_ADT7470 is not set # CONFIG_SENSORS_ADT7475 is not set # CONFIG_SENSORS_AHT10 is not set # CONFIG_SENSORS_AS370 is not set # CONFIG_SENSORS_ASC7621 is not set # CONFIG_SENSORS_ASUS_ROG_RYUJIN is not set # CONFIG_SENSORS_AXI_FAN_CONTROL is not set # CONFIG_SENSORS_K8TEMP is not set # CONFIG_SENSORS_APPLESMC is not set # CONFIG_SENSORS_ASB100 is not set # CONFIG_SENSORS_ATXP1 is not set # CONFIG_SENSORS_CHIPCAP2 is not set # CONFIG_SENSORS_CORSAIR_CPRO is not set # CONFIG_SENSORS_CORSAIR_PSU is not set # CONFIG_SENSORS_DRIVETEMP is not set # CONFIG_SENSORS_DS620 is not set # CONFIG_SENSORS_DS1621 is not set # CONFIG_SENSORS_DELL_SMM is not set # CONFIG_SENSORS_I5K_AMB is not set # CONFIG_SENSORS_F71805F is not set # CONFIG_SENSORS_F71882FG is not set # CONFIG_SENSORS_F75375S is not set # CONFIG_SENSORS_FSCHMD is not set # CONFIG_SENSORS_FTSTEUTATES is not set # CONFIG_SENSORS_GL518SM is not set # CONFIG_SENSORS_GL520SM is not set # CONFIG_SENSORS_G760A is not set # CONFIG_SENSORS_G762 is not set # CONFIG_SENSORS_HIH6130 is not set # CONFIG_SENSORS_HS3001 is not set # CONFIG_SENSORS_I5500 is not set # CONFIG_SENSORS_CORETEMP is not set # CONFIG_SENSORS_IT87 is not set # CONFIG_SENSORS_JC42 is not set # CONFIG_SENSORS_POWR1220 is not set # CONFIG_SENSORS_LENOVO_EC is not set # CONFIG_SENSORS_LINEAGE is not set # CONFIG_SENSORS_LTC2945 is not set # CONFIG_SENSORS_LTC2947_I2C is not set # CONFIG_SENSORS_LTC2990 is not set # CONFIG_SENSORS_LTC2991 is not set # CONFIG_SENSORS_LTC4151 is not set # CONFIG_SENSORS_LTC4215 is not set # CONFIG_SENSORS_LTC4222 is not set # CONFIG_SENSORS_LTC4245 is not set # CONFIG_SENSORS_LTC4260 is not set # CONFIG_SENSORS_LTC4261 is not set # CONFIG_SENSORS_LTC4282 is not set # CONFIG_SENSORS_MAX127 is not set # CONFIG_SENSORS_MAX16065 is not set # CONFIG_SENSORS_MAX1619 is not set # CONFIG_SENSORS_MAX1668 is not set # CONFIG_SENSORS_MAX197 is not set # CONFIG_SENSORS_MAX31730 is not set # CONFIG_SENSORS_MAX31760 is not set # CONFIG_MAX31827 is not set # CONFIG_SENSORS_MAX6620 is not set # CONFIG_SENSORS_MAX6621 is not set # CONFIG_SENSORS_MAX6639 is not set # CONFIG_SENSORS_MAX6642 is not set # CONFIG_SENSORS_MAX6650 is not set # CONFIG_SENSORS_MAX6697 is not set # CONFIG_SENSORS_MAX31790 is not set # CONFIG_SENSORS_MC34VR500 is not set # CONFIG_SENSORS_MCP3021 is not set # CONFIG_SENSORS_TC654 is not set # CONFIG_SENSORS_TPS23861 is not set # CONFIG_SENSORS_MR75203 is not set # CONFIG_SENSORS_LM63 is not set # CONFIG_SENSORS_LM73 is not set # CONFIG_SENSORS_LM75 is not set # CONFIG_SENSORS_LM77 is not set # CONFIG_SENSORS_LM78 is not set # CONFIG_SENSORS_LM80 is not set # CONFIG_SENSORS_LM83 is not set # CONFIG_SENSORS_LM85 is not set # CONFIG_SENSORS_LM87 is not set # CONFIG_SENSORS_LM90 is not set # CONFIG_SENSORS_LM92 is not set # CONFIG_SENSORS_LM93 is not set # CONFIG_SENSORS_LM95234 is not set # CONFIG_SENSORS_LM95241 is not set # CONFIG_SENSORS_LM95245 is not set # CONFIG_SENSORS_PC87360 is not set # CONFIG_SENSORS_PC87427 is not set # CONFIG_SENSORS_NCT6683 is not set # CONFIG_SENSORS_NCT6775 is not set # CONFIG_SENSORS_NCT6775_I2C is not set # CONFIG_SENSORS_NCT7802 is not set # CONFIG_SENSORS_NCT7904 is not set # CONFIG_SENSORS_NPCM7XX is not set # CONFIG_SENSORS_OCC_P8_I2C is not set # CONFIG_SENSORS_OXP is not set # CONFIG_SENSORS_PCF8591 is not set # CONFIG_PMBUS is not set # CONFIG_SENSORS_PT5161L is not set # CONFIG_SENSORS_SBTSI is not set # CONFIG_SENSORS_SBRMI is not set # CONFIG_SENSORS_SHT21 is not set # CONFIG_SENSORS_SHT3x is not set # CONFIG_SENSORS_SHT4x is not set # CONFIG_SENSORS_SHTC1 is not set # CONFIG_SENSORS_SIS5595 is not set # CONFIG_SENSORS_DME1737 is not set # CONFIG_SENSORS_EMC1403 is not set # CONFIG_SENSORS_EMC2103 is not set # CONFIG_SENSORS_EMC2305 is not set # CONFIG_SENSORS_EMC6W201 is not set # CONFIG_SENSORS_SMSC47M1 is not set # CONFIG_SENSORS_SMSC47M192 is not set # CONFIG_SENSORS_SMSC47B397 is not set # CONFIG_SENSORS_SCH5627 is not set # CONFIG_SENSORS_SCH5636 is not set # CONFIG_SENSORS_STTS751 is not set # CONFIG_SENSORS_ADC128D818 is not set # CONFIG_SENSORS_ADS7828 is not set # CONFIG_SENSORS_AMC6821 is not set # CONFIG_SENSORS_INA209 is not set # CONFIG_SENSORS_INA2XX is not set # CONFIG_SENSORS_INA238 is not set # CONFIG_SENSORS_INA3221 is not set # CONFIG_SENSORS_TC74 is not set # CONFIG_SENSORS_THMC50 is not set # CONFIG_SENSORS_TMP102 is not set # CONFIG_SENSORS_TMP103 is not set # CONFIG_SENSORS_TMP108 is not set # CONFIG_SENSORS_TMP401 is not set # CONFIG_SENSORS_TMP421 is not set # CONFIG_SENSORS_TMP464 is not set # CONFIG_SENSORS_TMP513 is not set # CONFIG_SENSORS_VIA_CPUTEMP is not set # CONFIG_SENSORS_VIA686A is not set # CONFIG_SENSORS_VT1211 is not set # CONFIG_SENSORS_VT8231 is not set # CONFIG_SENSORS_W83773G is not set # CONFIG_SENSORS_W83781D is not set # CONFIG_SENSORS_W83791D is not set # CONFIG_SENSORS_W83792D is not set # CONFIG_SENSORS_W83793 is not set # CONFIG_SENSORS_W83795 is not set # CONFIG_SENSORS_W83L785TS is not set # CONFIG_SENSORS_W83L786NG is not set # CONFIG_SENSORS_W83627HF is not set # CONFIG_SENSORS_W83627EHF is not set # CONFIG_SENSORS_XGENE is not set # # ACPI drivers # # CONFIG_SENSORS_ACPI_POWER is not set # CONFIG_SENSORS_ATK0110 is not set # CONFIG_SENSORS_ASUS_WMI is not set # CONFIG_SENSORS_ASUS_EC is not set # CONFIG_SENSORS_HP_WMI is not set CONFIG_THERMAL=y CONFIG_THERMAL_NETLINK=y # CONFIG_THERMAL_STATISTICS is not set # CONFIG_THERMAL_DEBUGFS is not set CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 CONFIG_THERMAL_HWMON=y CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y # CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set # CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set # CONFIG_THERMAL_GOV_FAIR_SHARE is not set CONFIG_THERMAL_GOV_STEP_WISE=y # CONFIG_THERMAL_GOV_BANG_BANG is not set CONFIG_THERMAL_GOV_USER_SPACE=y # CONFIG_THERMAL_EMULATION is not set # # Intel thermal drivers # # CONFIG_INTEL_POWERCLAMP is not set CONFIG_X86_THERMAL_VECTOR=y CONFIG_INTEL_TCC=y CONFIG_X86_PKG_TEMP_THERMAL=y # CONFIG_INTEL_SOC_DTS_THERMAL is not set # # ACPI INT340X thermal drivers # # CONFIG_INT340X_THERMAL is not set # end of ACPI INT340X thermal drivers # CONFIG_INTEL_PCH_THERMAL is not set # CONFIG_INTEL_TCC_COOLING is not set CONFIG_INTEL_HFI_THERMAL=y # end of Intel thermal drivers CONFIG_WATCHDOG=y CONFIG_WATCHDOG_CORE=y # CONFIG_WATCHDOG_NOWAYOUT is not set CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y CONFIG_WATCHDOG_OPEN_TIMEOUT=0 # CONFIG_WATCHDOG_SYSFS is not set CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT=y # # Watchdog Pretimeout Governors # CONFIG_WATCHDOG_PRETIMEOUT_GOV=y CONFIG_WATCHDOG_PRETIMEOUT_GOV_SEL=m CONFIG_WATCHDOG_PRETIMEOUT_GOV_NOOP=y CONFIG_WATCHDOG_PRETIMEOUT_GOV_PANIC=y # CONFIG_WATCHDOG_PRETIMEOUT_DEFAULT_GOV_NOOP is not set CONFIG_WATCHDOG_PRETIMEOUT_DEFAULT_GOV_PANIC=y # # Watchdog Device Drivers # # CONFIG_SOFT_WATCHDOG is not set # CONFIG_LENOVO_SE10_WDT is not set # CONFIG_WDAT_WDT is not set # CONFIG_XILINX_WATCHDOG is not set # CONFIG_ZIIRAVE_WATCHDOG is not set # CONFIG_CADENCE_WATCHDOG is not set # CONFIG_DW_WATCHDOG is not set # CONFIG_MAX63XX_WATCHDOG is not set # CONFIG_ACQUIRE_WDT is not set # CONFIG_ADVANTECH_WDT is not set # CONFIG_ADVANTECH_EC_WDT is not set # CONFIG_ALIM1535_WDT is not set # CONFIG_ALIM7101_WDT is not set # CONFIG_EBC_C384_WDT is not set # CONFIG_EXAR_WDT is not set # CONFIG_F71808E_WDT is not set # CONFIG_SP5100_TCO is not set # CONFIG_SBC_FITPC2_WATCHDOG is not set # CONFIG_EUROTECH_WDT is not set # CONFIG_IB700_WDT is not set # CONFIG_IBMASR is not set # CONFIG_WAFER_WDT is not set # CONFIG_I6300ESB_WDT is not set # CONFIG_IE6XX_WDT is not set # CONFIG_ITCO_WDT is not set # CONFIG_IT8712F_WDT is not set # CONFIG_IT87_WDT is not set # CONFIG_HP_WATCHDOG is not set # CONFIG_SC1200_WDT is not set # CONFIG_PC87413_WDT is not set # CONFIG_NV_TCO is not set # CONFIG_60XX_WDT is not set # CONFIG_CPU5_WDT is not set # CONFIG_SMSC_SCH311X_WDT is not set # CONFIG_SMSC37B787_WDT is not set # CONFIG_TQMX86_WDT is not set # CONFIG_VIA_WDT is not set # CONFIG_W83627HF_WDT is not set # CONFIG_W83877F_WDT is not set # CONFIG_W83977F_WDT is not set # CONFIG_MACHZ_WDT is not set # CONFIG_SBC_EPX_C3_WATCHDOG is not set # CONFIG_NI903X_WDT is not set # CONFIG_NIC7018_WDT is not set # # PCI-based Watchdog Cards # # CONFIG_PCIPCWATCHDOG is not set # CONFIG_WDTPCI is not set CONFIG_SSB_POSSIBLE=y # CONFIG_SSB is not set CONFIG_BCMA_POSSIBLE=y # CONFIG_BCMA is not set # # Multifunction device drivers # # CONFIG_MFD_AS3711 is not set # CONFIG_MFD_SMPRO is not set # CONFIG_PMIC_ADP5520 is not set # CONFIG_MFD_BCM590XX is not set # CONFIG_MFD_BD9571MWV is not set # CONFIG_MFD_AXP20X_I2C is not set # CONFIG_MFD_CS42L43_I2C is not set # CONFIG_MFD_MADERA is not set # CONFIG_PMIC_DA903X is not set # CONFIG_MFD_DA9052_I2C is not set # CONFIG_MFD_DA9055 is not set # CONFIG_MFD_DA9062 is not set # CONFIG_MFD_DA9063 is not set # CONFIG_MFD_DA9150 is not set # CONFIG_MFD_MC13XXX_I2C is not set # CONFIG_MFD_MP2629 is not set # CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set # CONFIG_LPC_ICH is not set # CONFIG_LPC_SCH is not set # CONFIG_MFD_INTEL_LPSS_ACPI is not set # CONFIG_MFD_INTEL_LPSS_PCI is not set # CONFIG_MFD_INTEL_PMC_BXT is not set # CONFIG_MFD_IQS62X is not set # CONFIG_MFD_JANZ_CMODIO is not set # CONFIG_MFD_KEMPLD is not set # CONFIG_MFD_88PM800 is not set # CONFIG_MFD_88PM805 is not set # CONFIG_MFD_88PM860X is not set # CONFIG_MFD_MAX14577 is not set # CONFIG_MFD_MAX77541 is not set # CONFIG_MFD_MAX77693 is not set # CONFIG_MFD_MAX77843 is not set # CONFIG_MFD_MAX8907 is not set # CONFIG_MFD_MAX8925 is not set # CONFIG_MFD_MAX8997 is not set # CONFIG_MFD_MAX8998 is not set # CONFIG_MFD_MT6360 is not set # CONFIG_MFD_MT6370 is not set # CONFIG_MFD_MT6397 is not set # CONFIG_MFD_MENF21BMC is not set # CONFIG_MFD_RETU is not set # CONFIG_MFD_PCF50633 is not set # CONFIG_MFD_SY7636A is not set # CONFIG_MFD_RDC321X is not set # CONFIG_MFD_RT4831 is not set # CONFIG_MFD_RT5033 is not set # CONFIG_MFD_RT5120 is not set # CONFIG_MFD_RC5T583 is not set # CONFIG_MFD_SI476X_CORE is not set # CONFIG_MFD_SM501 is not set # CONFIG_MFD_SKY81452 is not set # CONFIG_MFD_SYSCON is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_LP8788 is not set # CONFIG_MFD_TI_LMU is not set # CONFIG_MFD_PALMAS is not set # CONFIG_TPS6105X is not set # CONFIG_TPS6507X is not set # CONFIG_MFD_TPS65086 is not set # CONFIG_MFD_TPS65090 is not set # CONFIG_MFD_TI_LP873X is not set # CONFIG_MFD_TPS6586X is not set # CONFIG_MFD_TPS65912_I2C is not set # CONFIG_MFD_TPS6594_I2C is not set # CONFIG_TWL4030_CORE is not set # CONFIG_TWL6040_CORE is not set # CONFIG_MFD_WL1273_CORE is not set # CONFIG_MFD_LM3533 is not set # CONFIG_MFD_TQMX86 is not set # CONFIG_MFD_VX855 is not set # CONFIG_MFD_ARIZONA_I2C is not set # CONFIG_MFD_WM8400 is not set # CONFIG_MFD_WM831X_I2C is not set # CONFIG_MFD_WM8350_I2C is not set # CONFIG_MFD_WM8994 is not set # CONFIG_MFD_ATC260X_I2C is not set # end of Multifunction device drivers # CONFIG_REGULATOR is not set # CONFIG_RC_CORE is not set # # CEC support # # CONFIG_MEDIA_CEC_SUPPORT is not set # end of CEC support # CONFIG_MEDIA_SUPPORT is not set # # Graphics support # # CONFIG_AUXDISPLAY is not set # CONFIG_AGP is not set # CONFIG_VGA_SWITCHEROO is not set # CONFIG_DRM is not set # # Frame buffer Devices # # CONFIG_FB is not set # end of Frame buffer Devices # # Backlight & LCD device support # # CONFIG_LCD_CLASS_DEVICE is not set # CONFIG_BACKLIGHT_CLASS_DEVICE is not set # end of Backlight & LCD device support # # Console display driver support # CONFIG_VGA_CONSOLE=y CONFIG_DUMMY_CONSOLE=y CONFIG_DUMMY_CONSOLE_COLUMNS=80 CONFIG_DUMMY_CONSOLE_ROWS=25 # end of Console display driver support # end of Graphics support # CONFIG_SOUND is not set CONFIG_HID_SUPPORT=y CONFIG_HID=y # CONFIG_HID_BATTERY_STRENGTH is not set # CONFIG_HIDRAW is not set # CONFIG_UHID is not set CONFIG_HID_GENERIC=y # # Special HID drivers # # CONFIG_HID_A4TECH is not set # CONFIG_HID_ACRUX is not set # CONFIG_HID_AUREAL is not set # CONFIG_HID_BELKIN is not set # CONFIG_HID_CHERRY is not set # CONFIG_HID_COUGAR is not set # CONFIG_HID_MACALLY is not set # CONFIG_HID_CMEDIA is not set # CONFIG_HID_CYPRESS is not set # CONFIG_HID_DRAGONRISE is not set # CONFIG_HID_EMS_FF is not set # CONFIG_HID_ELECOM is not set # CONFIG_HID_EVISION is not set # CONFIG_HID_EZKEY is not set # CONFIG_HID_GEMBIRD is not set # CONFIG_HID_GFRM is not set # CONFIG_HID_GLORIOUS is not set # CONFIG_HID_GOOGLE_STADIA_FF is not set # CONFIG_HID_VIVALDI is not set # CONFIG_HID_KEYTOUCH is not set # CONFIG_HID_KYE is not set # CONFIG_HID_WALTOP is not set # CONFIG_HID_VIEWSONIC is not set # CONFIG_HID_VRC2 is not set # CONFIG_HID_XIAOMI is not set # CONFIG_HID_GYRATION is not set # CONFIG_HID_ICADE is not set # CONFIG_HID_ITE is not set # CONFIG_HID_JABRA is not set # CONFIG_HID_TWINHAN is not set # CONFIG_HID_KENSINGTON is not set # CONFIG_HID_LCPOWER is not set # CONFIG_HID_LENOVO is not set # CONFIG_HID_MAGICMOUSE is not set # CONFIG_HID_MALTRON is not set # CONFIG_HID_MAYFLASH is not set # CONFIG_HID_REDRAGON is not set # CONFIG_HID_MICROSOFT is not set # CONFIG_HID_MONTEREY is not set # CONFIG_HID_MULTITOUCH is not set # CONFIG_HID_NTI is not set # CONFIG_HID_ORTEK is not set # CONFIG_HID_PANTHERLORD is not set # CONFIG_HID_PETALYNX is not set # CONFIG_HID_PICOLCD is not set # CONFIG_HID_PLANTRONICS is not set # CONFIG_HID_PXRC is not set # CONFIG_HID_RAZER is not set # CONFIG_HID_PRIMAX is not set # CONFIG_HID_SAITEK is not set # CONFIG_HID_SEMITEK is not set # CONFIG_HID_SPEEDLINK is not set # CONFIG_HID_STEAM is not set # CONFIG_HID_SUNPLUS is not set # CONFIG_HID_RMI is not set # CONFIG_HID_GREENASIA is not set # CONFIG_HID_SMARTJOYPLUS is not set # CONFIG_HID_TIVO is not set # CONFIG_HID_TOPSEED is not set # CONFIG_HID_TOPRE is not set # CONFIG_HID_UDRAW_PS3 is not set # CONFIG_HID_XINMO is not set # CONFIG_HID_ZEROPLUS is not set # CONFIG_HID_ZYDACRON is not set # CONFIG_HID_SENSOR_HUB is not set # CONFIG_HID_ALPS is not set # end of Special HID drivers # # HID-BPF support # # end of HID-BPF support CONFIG_I2C_HID=y # CONFIG_I2C_HID_ACPI is not set # CONFIG_I2C_HID_OF is not set # # Intel ISH HID support # # CONFIG_INTEL_ISH_HID is not set # end of Intel ISH HID support # # AMD SFH HID Support # # CONFIG_AMD_SFH_HID is not set # end of AMD SFH HID Support CONFIG_USB_OHCI_LITTLE_ENDIAN=y # CONFIG_USB_SUPPORT is not set # CONFIG_MMC is not set # CONFIG_SCSI_UFSHCD is not set # CONFIG_MEMSTICK is not set # CONFIG_NEW_LEDS is not set # CONFIG_ACCESSIBILITY is not set # CONFIG_INFINIBAND is not set CONFIG_EDAC_ATOMIC_SCRUB=y CONFIG_EDAC_SUPPORT=y CONFIG_RTC_LIB=y CONFIG_RTC_MC146818_LIB=y # CONFIG_RTC_CLASS is not set # CONFIG_DMADEVICES is not set # # DMABUF options # CONFIG_SYNC_FILE=y # CONFIG_SW_SYNC is not set # CONFIG_UDMABUF is not set # CONFIG_DMABUF_MOVE_NOTIFY is not set CONFIG_DMABUF_DEBUG=y # CONFIG_DMABUF_SELFTESTS is not set # CONFIG_DMABUF_HEAPS is not set # CONFIG_DMABUF_SYSFS_STATS is not set # end of DMABUF options # CONFIG_UIO is not set # CONFIG_VFIO is not set CONFIG_IRQ_BYPASS_MANAGER=y # CONFIG_VIRT_DRIVERS is not set CONFIG_VIRTIO_ANCHOR=y CONFIG_VIRTIO=y CONFIG_VIRTIO_PCI_LIB=y CONFIG_VIRTIO_PCI_LIB_LEGACY=y CONFIG_VIRTIO_MENU=y CONFIG_VIRTIO_PCI=y CONFIG_VIRTIO_PCI_ADMIN_LEGACY=y CONFIG_VIRTIO_PCI_LEGACY=y # CONFIG_VIRTIO_PMEM is not set # CONFIG_VIRTIO_BALLOON is not set # CONFIG_VIRTIO_INPUT is not set # CONFIG_VIRTIO_MMIO is not set # CONFIG_VIRTIO_DEBUG is not set # CONFIG_VDPA is not set # CONFIG_VHOST_MENU is not set # # Microsoft Hyper-V guest support # # CONFIG_HYPERV is not set # end of Microsoft Hyper-V guest support # CONFIG_GREYBUS is not set # CONFIG_COMEDI is not set # CONFIG_STAGING is not set # CONFIG_GOLDFISH is not set # CONFIG_CHROME_PLATFORMS is not set # CONFIG_MELLANOX_PLATFORM is not set # CONFIG_SURFACE_PLATFORMS is not set CONFIG_X86_PLATFORM_DEVICES=y CONFIG_ACPI_WMI=y CONFIG_WMI_BMOF=y # CONFIG_MXM_WMI is not set # CONFIG_XIAOMI_WMI is not set # CONFIG_GIGABYTE_WMI is not set # CONFIG_YOGABOOK is not set # CONFIG_ACERHDF is not set # CONFIG_ACER_WIRELESS is not set # CONFIG_AMD_WBRF is not set # CONFIG_ADV_SWBUTTON is not set # CONFIG_ASUS_WIRELESS is not set # CONFIG_X86_PLATFORM_DRIVERS_DELL is not set # CONFIG_FUJITSU_TABLET is not set # CONFIG_GPD_POCKET_FAN is not set # CONFIG_X86_PLATFORM_DRIVERS_HP is not set # CONFIG_WIRELESS_HOTKEY is not set # CONFIG_IBM_RTL is not set # CONFIG_LENOVO_YMC is not set # CONFIG_SENSORS_HDAPS is not set # CONFIG_THINKPAD_LMI is not set # CONFIG_INTEL_IFS is not set # CONFIG_INTEL_SAR_INT1092 is not set # # Intel Speed Select Technology interface support # # CONFIG_INTEL_SPEED_SELECT_INTERFACE is not set # end of Intel Speed Select Technology interface support # CONFIG_INTEL_WMI_SBL_FW_UPDATE is not set # CONFIG_INTEL_WMI_THUNDERBOLT is not set # # Intel Uncore Frequency Control # # CONFIG_INTEL_UNCORE_FREQ_CONTROL is not set # end of Intel Uncore Frequency Control # CONFIG_INTEL_HID_EVENT is not set # CONFIG_INTEL_VBTN is not set # CONFIG_INTEL_PUNIT_IPC is not set # CONFIG_INTEL_RST is not set # CONFIG_INTEL_SMARTCONNECT is not set # CONFIG_INTEL_TURBO_MAX_3 is not set # CONFIG_INTEL_VSEC is not set # CONFIG_ACPI_QUICKSTART is not set # CONFIG_MSI_WMI_PLATFORM is not set # CONFIG_SAMSUNG_Q10 is not set # CONFIG_TOSHIBA_BT_RFKILL is not set # CONFIG_TOSHIBA_HAPS is not set # CONFIG_TOSHIBA_WMI is not set # CONFIG_ACPI_CMPC is not set # CONFIG_TOPSTAR_LAPTOP is not set # CONFIG_MLX_PLATFORM is not set # CONFIG_INSPUR_PLATFORM_PROFILE is not set # CONFIG_LENOVO_WMI_CAMERA is not set # CONFIG_INTEL_IPS is not set # CONFIG_INTEL_SCU_PCI is not set # CONFIG_INTEL_SCU_PLATFORM is not set # CONFIG_SIEMENS_SIMATIC_IPC is not set # CONFIG_WINMATE_FM07_KEYS is not set CONFIG_HAVE_CLK=y CONFIG_HAVE_CLK_PREPARE=y CONFIG_COMMON_CLK=y # CONFIG_COMMON_CLK_MAX9485 is not set # CONFIG_COMMON_CLK_SI5341 is not set # CONFIG_COMMON_CLK_SI5351 is not set # CONFIG_COMMON_CLK_SI544 is not set # CONFIG_COMMON_CLK_CDCE706 is not set # CONFIG_COMMON_CLK_CS2000_CP is not set # CONFIG_XILINX_VCU is not set # CONFIG_CLK_KUNIT_TEST is not set # CONFIG_CLK_GATE_KUNIT_TEST is not set # CONFIG_CLK_FD_KUNIT_TEST is not set # CONFIG_HWSPINLOCK is not set # # Clock Source drivers # CONFIG_CLKEVT_I8253=y CONFIG_CLKBLD_I8253=y # end of Clock Source drivers CONFIG_MAILBOX=y CONFIG_PCC=y # CONFIG_ALTERA_MBOX is not set # CONFIG_IOMMU_SUPPORT is not set # # Remoteproc drivers # # CONFIG_REMOTEPROC is not set # end of Remoteproc drivers # # Rpmsg drivers # # CONFIG_RPMSG_QCOM_GLINK_RPM is not set # CONFIG_RPMSG_VIRTIO is not set # end of Rpmsg drivers # CONFIG_SOUNDWIRE is not set # # SOC (System On Chip) specific Drivers # # # Amlogic SoC drivers # # end of Amlogic SoC drivers # # Broadcom SoC drivers # # end of Broadcom SoC drivers # # NXP/Freescale QorIQ SoC drivers # # end of NXP/Freescale QorIQ SoC drivers # # fujitsu SoC drivers # # end of fujitsu SoC drivers # # i.MX SoC drivers # # end of i.MX SoC drivers # # Enable LiteX SoC Builder specific drivers # # end of Enable LiteX SoC Builder specific drivers # CONFIG_WPCM450_SOC is not set # # Qualcomm SoC drivers # # end of Qualcomm SoC drivers # CONFIG_SOC_TI is not set # # Xilinx SoC drivers # # end of Xilinx SoC drivers # end of SOC (System On Chip) specific Drivers # # PM Domains # # # Amlogic PM Domains # # end of Amlogic PM Domains # # Broadcom PM Domains # # end of Broadcom PM Domains # # i.MX PM Domains # # end of i.MX PM Domains # # Qualcomm PM Domains # # end of Qualcomm PM Domains # end of PM Domains # CONFIG_PM_DEVFREQ is not set # CONFIG_EXTCON is not set # CONFIG_MEMORY is not set # CONFIG_IIO is not set # CONFIG_NTB is not set # CONFIG_PWM is not set # # IRQ chip support # # end of IRQ chip support # CONFIG_IPACK_BUS is not set # CONFIG_RESET_CONTROLLER is not set # # PHY Subsystem # # CONFIG_GENERIC_PHY is not set # CONFIG_PHY_CAN_TRANSCEIVER is not set # # PHY drivers for Broadcom platforms # # CONFIG_BCM_KONA_USB2_PHY is not set # end of PHY drivers for Broadcom platforms # CONFIG_PHY_PXA_28NM_HSIC is not set # CONFIG_PHY_PXA_28NM_USB2 is not set # CONFIG_PHY_INTEL_LGM_EMMC is not set # end of PHY Subsystem # CONFIG_POWERCAP is not set # CONFIG_MCB is not set # # Performance monitor support # # CONFIG_DWC_PCIE_PMU is not set # end of Performance monitor support # CONFIG_RAS is not set # CONFIG_USB4 is not set # # Android # CONFIG_ANDROID_BINDER_IPC=y CONFIG_ANDROID_BINDERFS=y CONFIG_ANDROID_BINDER_DEVICES="y" CONFIG_ANDROID_BINDER_IPC_SELFTEST=y # end of Android CONFIG_LIBNVDIMM=y CONFIG_BLK_DEV_PMEM=y CONFIG_ND_CLAIM=y CONFIG_ND_BTT=y CONFIG_BTT=y CONFIG_DAX=y # CONFIG_DEV_DAX is not set # CONFIG_NVMEM is not set # # HW tracing support # # CONFIG_STM is not set # CONFIG_INTEL_TH is not set # end of HW tracing support # CONFIG_FPGA is not set # CONFIG_SIOX is not set # CONFIG_SLIMBUS is not set # CONFIG_INTERCONNECT is not set # CONFIG_COUNTER is not set # CONFIG_PECI is not set # CONFIG_HTE is not set # end of Device Drivers # # File systems # CONFIG_DCACHE_WORD_ACCESS=y # CONFIG_VALIDATE_FS_PARSER is not set CONFIG_FS_IOMAP=y CONFIG_BUFFER_HEAD=y # CONFIG_EXT2_FS is not set # CONFIG_EXT3_FS is not set CONFIG_EXT4_FS=y CONFIG_EXT4_USE_FOR_EXT2=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set # CONFIG_EXT4_KUNIT_TESTS is not set CONFIG_JBD2=y # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=y # CONFIG_REISERFS_FS is not set # CONFIG_JFS_FS is not set # CONFIG_XFS_FS is not set # CONFIG_GFS2_FS is not set # CONFIG_BTRFS_FS is not set # CONFIG_NILFS2_FS is not set # CONFIG_F2FS_FS is not set # CONFIG_BCACHEFS_FS is not set # CONFIG_ZONEFS_FS is not set CONFIG_FS_POSIX_ACL=y CONFIG_EXPORTFS=y CONFIG_EXPORTFS_BLOCK_OPS=y CONFIG_FILE_LOCKING=y CONFIG_FS_ENCRYPTION=y CONFIG_FS_ENCRYPTION_ALGS=y # CONFIG_FS_VERITY is not set CONFIG_FSNOTIFY=y CONFIG_DNOTIFY=y CONFIG_INOTIFY_USER=y CONFIG_FANOTIFY=y # CONFIG_QUOTA is not set CONFIG_AUTOFS_FS=y # CONFIG_FUSE_FS is not set # CONFIG_OVERLAY_FS is not set # # Caches # CONFIG_NETFS_SUPPORT=y # CONFIG_NETFS_STATS is not set # CONFIG_FSCACHE is not set # end of Caches # # CD-ROM/DVD Filesystems # # CONFIG_ISO9660_FS is not set # CONFIG_UDF_FS is not set # end of CD-ROM/DVD Filesystems # # DOS/FAT/EXFAT/NT Filesystems # # CONFIG_MSDOS_FS is not set # CONFIG_VFAT_FS is not set # CONFIG_EXFAT_FS is not set # CONFIG_NTFS3_FS is not set # CONFIG_NTFS_FS is not set # end of DOS/FAT/EXFAT/NT Filesystems # # Pseudo filesystems # CONFIG_PROC_FS=y # CONFIG_PROC_KCORE is not set CONFIG_PROC_SYSCTL=y CONFIG_PROC_PAGE_MONITOR=y # CONFIG_PROC_CHILDREN is not set CONFIG_PROC_PID_ARCH_STATUS=y CONFIG_PROC_CPU_RESCTRL=y CONFIG_KERNFS=y CONFIG_SYSFS=y CONFIG_TMPFS=y CONFIG_TMPFS_POSIX_ACL=y CONFIG_TMPFS_XATTR=y # CONFIG_TMPFS_INODE64 is not set # CONFIG_TMPFS_QUOTA is not set CONFIG_HUGETLBFS=y CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y CONFIG_HUGETLB_PAGE=y CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y CONFIG_ARCH_HAS_GIGANTIC_PAGE=y # CONFIG_CONFIGFS_FS is not set # CONFIG_EFIVAR_FS is not set # end of Pseudo filesystems CONFIG_MISC_FILESYSTEMS=y # CONFIG_ORANGEFS_FS is not set # CONFIG_ADFS_FS is not set # CONFIG_AFFS_FS is not set # CONFIG_ECRYPT_FS is not set # CONFIG_HFS_FS is not set # CONFIG_HFSPLUS_FS is not set # CONFIG_BEFS_FS is not set # CONFIG_BFS_FS is not set # CONFIG_EFS_FS is not set # CONFIG_CRAMFS is not set # CONFIG_SQUASHFS is not set # CONFIG_VXFS_FS is not set # CONFIG_MINIX_FS is not set # CONFIG_OMFS_FS is not set # CONFIG_HPFS_FS is not set # CONFIG_QNX4FS_FS is not set # CONFIG_QNX6FS_FS is not set # CONFIG_ROMFS_FS is not set CONFIG_PSTORE=y CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240 CONFIG_PSTORE_COMPRESS=y CONFIG_PSTORE_CONSOLE=y # CONFIG_PSTORE_PMSG is not set # CONFIG_PSTORE_RAM is not set # CONFIG_PSTORE_BLK is not set # CONFIG_SYSV_FS is not set # CONFIG_UFS_FS is not set # CONFIG_EROFS_FS is not set # CONFIG_NETWORK_FILESYSTEMS is not set CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf-8" # CONFIG_NLS_CODEPAGE_437 is not set # CONFIG_NLS_CODEPAGE_737 is not set # CONFIG_NLS_CODEPAGE_775 is not set # CONFIG_NLS_CODEPAGE_850 is not set # CONFIG_NLS_CODEPAGE_852 is not set # CONFIG_NLS_CODEPAGE_855 is not set # CONFIG_NLS_CODEPAGE_857 is not set # CONFIG_NLS_CODEPAGE_860 is not set # CONFIG_NLS_CODEPAGE_861 is not set # CONFIG_NLS_CODEPAGE_862 is not set # CONFIG_NLS_CODEPAGE_863 is not set # CONFIG_NLS_CODEPAGE_864 is not set # CONFIG_NLS_CODEPAGE_865 is not set # CONFIG_NLS_CODEPAGE_866 is not set # CONFIG_NLS_CODEPAGE_869 is not set # CONFIG_NLS_CODEPAGE_936 is not set # CONFIG_NLS_CODEPAGE_950 is not set # CONFIG_NLS_CODEPAGE_932 is not set # CONFIG_NLS_CODEPAGE_949 is not set # CONFIG_NLS_CODEPAGE_874 is not set # CONFIG_NLS_ISO8859_8 is not set # CONFIG_NLS_CODEPAGE_1250 is not set # CONFIG_NLS_CODEPAGE_1251 is not set # CONFIG_NLS_ASCII is not set # CONFIG_NLS_ISO8859_1 is not set # CONFIG_NLS_ISO8859_2 is not set # CONFIG_NLS_ISO8859_3 is not set # CONFIG_NLS_ISO8859_4 is not set # CONFIG_NLS_ISO8859_5 is not set # CONFIG_NLS_ISO8859_6 is not set # CONFIG_NLS_ISO8859_7 is not set # CONFIG_NLS_ISO8859_9 is not set # CONFIG_NLS_ISO8859_13 is not set # CONFIG_NLS_ISO8859_14 is not set # CONFIG_NLS_ISO8859_15 is not set # CONFIG_NLS_KOI8_R is not set # CONFIG_NLS_KOI8_U is not set # CONFIG_NLS_MAC_ROMAN is not set # CONFIG_NLS_MAC_CELTIC is not set # CONFIG_NLS_MAC_CENTEURO is not set # CONFIG_NLS_MAC_CROATIAN is not set # CONFIG_NLS_MAC_CYRILLIC is not set # CONFIG_NLS_MAC_GAELIC is not set # CONFIG_NLS_MAC_GREEK is not set # CONFIG_NLS_MAC_ICELAND is not set # CONFIG_NLS_MAC_INUIT is not set # CONFIG_NLS_MAC_ROMANIAN is not set # CONFIG_NLS_MAC_TURKISH is not set # CONFIG_NLS_UTF8 is not set # CONFIG_UNICODE is not set CONFIG_IO_WQ=y # end of File systems # # Security options # CONFIG_KEYS=y # CONFIG_KEYS_REQUEST_CACHE is not set CONFIG_PERSISTENT_KEYRINGS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set # CONFIG_KEY_DH_OPERATIONS is not set # CONFIG_SECURITY_DMESG_RESTRICT is not set # CONFIG_SECURITY is not set # CONFIG_SECURITYFS is not set CONFIG_HARDENED_USERCOPY=y # CONFIG_FORTIFY_SOURCE is not set # CONFIG_STATIC_USERMODEHELPER is not set # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf" # # Kernel hardening options # # # Memory initialization # CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y CONFIG_INIT_STACK_NONE=y # CONFIG_INIT_STACK_ALL_PATTERN is not set # CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y # CONFIG_ZERO_CALL_USED_REGS is not set # end of Memory initialization # # Hardening of kernel data structures # CONFIG_LIST_HARDENED=y CONFIG_BUG_ON_DATA_CORRUPTION=y # end of Hardening of kernel data structures CONFIG_RANDSTRUCT_NONE=y # end of Kernel hardening options # end of Security options CONFIG_CRYPTO=y # # Crypto core or helper # CONFIG_CRYPTO_ALGAPI=y CONFIG_CRYPTO_ALGAPI2=y CONFIG_CRYPTO_AEAD=y CONFIG_CRYPTO_AEAD2=y CONFIG_CRYPTO_SIG2=y CONFIG_CRYPTO_SKCIPHER=y CONFIG_CRYPTO_SKCIPHER2=y CONFIG_CRYPTO_HASH=y CONFIG_CRYPTO_HASH2=y CONFIG_CRYPTO_RNG=y CONFIG_CRYPTO_RNG2=y CONFIG_CRYPTO_RNG_DEFAULT=y CONFIG_CRYPTO_AKCIPHER2=y CONFIG_CRYPTO_KPP2=y CONFIG_CRYPTO_KPP=y CONFIG_CRYPTO_ACOMP2=y CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y # CONFIG_CRYPTO_USER is not set # CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set # CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is not set CONFIG_CRYPTO_NULL=y CONFIG_CRYPTO_NULL2=y # CONFIG_CRYPTO_PCRYPT is not set # CONFIG_CRYPTO_CRYPTD is not set CONFIG_CRYPTO_AUTHENC=y # CONFIG_CRYPTO_TEST is not set # end of Crypto core or helper # # Public-key cryptography # # CONFIG_CRYPTO_RSA is not set # CONFIG_CRYPTO_DH is not set CONFIG_CRYPTO_ECC=y CONFIG_CRYPTO_ECDH=y # CONFIG_CRYPTO_ECDSA is not set # CONFIG_CRYPTO_ECRDSA is not set # CONFIG_CRYPTO_SM2 is not set # CONFIG_CRYPTO_CURVE25519 is not set # end of Public-key cryptography # # Block ciphers # CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_AES_TI is not set # CONFIG_CRYPTO_ARIA is not set # CONFIG_CRYPTO_BLOWFISH is not set # CONFIG_CRYPTO_CAMELLIA is not set # CONFIG_CRYPTO_CAST5 is not set # CONFIG_CRYPTO_CAST6 is not set # CONFIG_CRYPTO_DES is not set # CONFIG_CRYPTO_FCRYPT is not set # CONFIG_CRYPTO_SERPENT is not set # CONFIG_CRYPTO_SM4_GENERIC is not set # CONFIG_CRYPTO_TWOFISH is not set # end of Block ciphers # # Length-preserving ciphers and modes # # CONFIG_CRYPTO_ADIANTUM is not set # CONFIG_CRYPTO_CHACHA20 is not set CONFIG_CRYPTO_CBC=y CONFIG_CRYPTO_CTR=y # CONFIG_CRYPTO_CTS is not set CONFIG_CRYPTO_ECB=y # CONFIG_CRYPTO_HCTR2 is not set # CONFIG_CRYPTO_KEYWRAP is not set # CONFIG_CRYPTO_LRW is not set # CONFIG_CRYPTO_PCBC is not set # CONFIG_CRYPTO_XTS is not set # end of Length-preserving ciphers and modes # # AEAD (authenticated encryption with associated data) ciphers # # CONFIG_CRYPTO_AEGIS128 is not set # CONFIG_CRYPTO_CHACHA20POLY1305 is not set # CONFIG_CRYPTO_CCM is not set CONFIG_CRYPTO_GCM=y CONFIG_CRYPTO_GENIV=y CONFIG_CRYPTO_SEQIV=y CONFIG_CRYPTO_ECHAINIV=y # CONFIG_CRYPTO_ESSIV is not set # end of AEAD (authenticated encryption with associated data) ciphers # # Hashes, digests, and MACs # # CONFIG_CRYPTO_BLAKE2B is not set # CONFIG_CRYPTO_CMAC is not set CONFIG_CRYPTO_GHASH=y CONFIG_CRYPTO_HMAC=y # CONFIG_CRYPTO_MD4 is not set # CONFIG_CRYPTO_MD5 is not set # CONFIG_CRYPTO_MICHAEL_MIC is not set # CONFIG_CRYPTO_POLY1305 is not set # CONFIG_CRYPTO_RMD160 is not set # CONFIG_CRYPTO_SHA1 is not set CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_CRYPTO_SHA3=y # CONFIG_CRYPTO_SM3_GENERIC is not set # CONFIG_CRYPTO_STREEBOG is not set # CONFIG_CRYPTO_VMAC is not set # CONFIG_CRYPTO_WP512 is not set # CONFIG_CRYPTO_XCBC is not set # CONFIG_CRYPTO_XXHASH is not set # end of Hashes, digests, and MACs # # CRCs (cyclic redundancy checks) # CONFIG_CRYPTO_CRC32C=y # CONFIG_CRYPTO_CRC32 is not set CONFIG_CRYPTO_CRCT10DIF=y CONFIG_CRYPTO_CRC64_ROCKSOFT=y # end of CRCs (cyclic redundancy checks) # # Compression # CONFIG_CRYPTO_DEFLATE=y # CONFIG_CRYPTO_LZO is not set # CONFIG_CRYPTO_842 is not set # CONFIG_CRYPTO_LZ4 is not set # CONFIG_CRYPTO_LZ4HC is not set # CONFIG_CRYPTO_ZSTD is not set # end of Compression # # Random number generation # # CONFIG_CRYPTO_ANSI_CPRNG is not set CONFIG_CRYPTO_DRBG_MENU=y CONFIG_CRYPTO_DRBG_HMAC=y # CONFIG_CRYPTO_DRBG_HASH is not set # CONFIG_CRYPTO_DRBG_CTR is not set CONFIG_CRYPTO_DRBG=y CONFIG_CRYPTO_JITTERENTROPY=y CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64 CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32 CONFIG_CRYPTO_JITTERENTROPY_OSR=1 # end of Random number generation # # Userspace interface # # CONFIG_CRYPTO_USER_API_HASH is not set # CONFIG_CRYPTO_USER_API_SKCIPHER is not set # CONFIG_CRYPTO_USER_API_RNG is not set # CONFIG_CRYPTO_USER_API_AEAD is not set # end of Userspace interface CONFIG_CRYPTO_HASH_INFO=y # # Accelerated Cryptographic Algorithms for CPU (x86) # # CONFIG_CRYPTO_CURVE25519_X86 is not set # CONFIG_CRYPTO_AES_NI_INTEL is not set # CONFIG_CRYPTO_BLOWFISH_X86_64 is not set # CONFIG_CRYPTO_CAMELLIA_X86_64 is not set # CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set # CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set # CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set # CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set # CONFIG_CRYPTO_DES3_EDE_X86_64 is not set # CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set # CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set # CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set # CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set # CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set # CONFIG_CRYPTO_TWOFISH_X86_64 is not set # CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set # CONFIG_CRYPTO_TWOFISH_AVX_X86_64 is not set # CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64 is not set # CONFIG_CRYPTO_ARIA_AESNI_AVX2_X86_64 is not set # CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64 is not set # CONFIG_CRYPTO_CHACHA20_X86_64 is not set # CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set # CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set # CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set # CONFIG_CRYPTO_BLAKE2S_X86 is not set # CONFIG_CRYPTO_POLYVAL_CLMUL_NI is not set # CONFIG_CRYPTO_POLY1305_X86_64 is not set # CONFIG_CRYPTO_SHA1_SSSE3 is not set # CONFIG_CRYPTO_SHA256_SSSE3 is not set # CONFIG_CRYPTO_SHA512_SSSE3 is not set # CONFIG_CRYPTO_SM3_AVX_X86_64 is not set # CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set # CONFIG_CRYPTO_CRC32C_INTEL is not set # CONFIG_CRYPTO_CRC32_PCLMUL is not set # CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set # end of Accelerated Cryptographic Algorithms for CPU (x86) # CONFIG_CRYPTO_HW is not set # CONFIG_ASYMMETRIC_KEY_TYPE is not set # # Certificates for signature checking # # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set # end of Certificates for signature checking CONFIG_BINARY_PRINTF=y # # Library routines # # CONFIG_PACKING is not set CONFIG_BITREVERSE=y CONFIG_GENERIC_STRNCPY_FROM_USER=y CONFIG_GENERIC_STRNLEN_USER=y CONFIG_GENERIC_NET_UTILS=y # CONFIG_CORDIC is not set # CONFIG_PRIME_NUMBERS is not set CONFIG_RATIONAL=y CONFIG_GENERIC_IOMAP=y CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y CONFIG_ARCH_HAS_FAST_MULTIPLIER=y CONFIG_ARCH_USE_SYM_ANNOTATIONS=y # # Crypto library routines # CONFIG_CRYPTO_LIB_UTILS=y CONFIG_CRYPTO_LIB_AES=y CONFIG_CRYPTO_LIB_AESCFB=y CONFIG_CRYPTO_LIB_GF128MUL=y CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y # CONFIG_CRYPTO_LIB_CHACHA is not set # CONFIG_CRYPTO_LIB_CURVE25519 is not set CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11 # CONFIG_CRYPTO_LIB_POLY1305 is not set # CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set CONFIG_CRYPTO_LIB_SHA1=y CONFIG_CRYPTO_LIB_SHA256=y # end of Crypto library routines CONFIG_CRC_CCITT=y CONFIG_CRC16=y CONFIG_CRC_T10DIF=y CONFIG_CRC64_ROCKSOFT=y # CONFIG_CRC_ITU_T is not set CONFIG_CRC32=y # CONFIG_CRC32_SELFTEST is not set CONFIG_CRC32_SLICEBY8=y # CONFIG_CRC32_SLICEBY4 is not set # CONFIG_CRC32_SARWATE is not set # CONFIG_CRC32_BIT is not set CONFIG_CRC64=y # CONFIG_CRC4 is not set # CONFIG_CRC7 is not set # CONFIG_LIBCRC32C is not set # CONFIG_CRC8 is not set CONFIG_XXHASH=y # CONFIG_RANDOM32_SELFTEST is not set CONFIG_ZLIB_INFLATE=y CONFIG_ZLIB_DEFLATE=y CONFIG_LZO_DECOMPRESS=y CONFIG_LZ4_DECOMPRESS=y CONFIG_ZSTD_COMMON=y CONFIG_ZSTD_DECOMPRESS=y CONFIG_XZ_DEC=y CONFIG_XZ_DEC_X86=y # CONFIG_XZ_DEC_POWERPC is not set # CONFIG_XZ_DEC_ARM is not set # CONFIG_XZ_DEC_ARMTHUMB is not set # CONFIG_XZ_DEC_SPARC is not set # CONFIG_XZ_DEC_MICROLZMA is not set CONFIG_XZ_DEC_BCJ=y # CONFIG_XZ_DEC_TEST is not set CONFIG_DECOMPRESS_GZIP=y CONFIG_DECOMPRESS_BZIP2=y CONFIG_DECOMPRESS_LZMA=y CONFIG_DECOMPRESS_XZ=y CONFIG_DECOMPRESS_LZO=y CONFIG_DECOMPRESS_LZ4=y CONFIG_DECOMPRESS_ZSTD=y CONFIG_GENERIC_ALLOCATOR=y CONFIG_INTERVAL_TREE=y CONFIG_XARRAY_MULTI=y CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_IOPORT=y CONFIG_HAS_IOPORT_MAP=y CONFIG_HAS_DMA=y CONFIG_NEED_SG_DMA_LENGTH=y CONFIG_NEED_DMA_MAP_STATE=y CONFIG_ARCH_DMA_ADDR_T_64BIT=y CONFIG_SWIOTLB=y # CONFIG_SWIOTLB_DYNAMIC is not set CONFIG_DMA_NEED_SYNC=y # CONFIG_DMA_API_DEBUG is not set # CONFIG_DMA_MAP_BENCHMARK is not set CONFIG_SGL_ALLOC=y CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_GLOB=y # CONFIG_GLOB_SELFTEST is not set CONFIG_NLATTR=y # CONFIG_IRQ_POLL is not set CONFIG_DIMLIB=y CONFIG_UCS2_STRING=y CONFIG_HAVE_GENERIC_VDSO=y CONFIG_GENERIC_GETTIMEOFDAY=y CONFIG_GENERIC_VDSO_TIME_NS=y CONFIG_GENERIC_VDSO_OVERFLOW_PROTECT=y CONFIG_FONT_SUPPORT=y CONFIG_FONT_8x16=y CONFIG_FONT_AUTOSELECT=y CONFIG_SG_POOL=y CONFIG_ARCH_HAS_PMEM_API=y CONFIG_MEMREGION=y CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y CONFIG_ARCH_HAS_COPY_MC=y CONFIG_ARCH_STACKWALK=y CONFIG_STACKDEPOT=y CONFIG_STACKDEPOT_ALWAYS_INIT=y CONFIG_STACKDEPOT_MAX_FRAMES=64 CONFIG_SBITMAP=y # CONFIG_LWQ_TEST is not set # end of Library routines CONFIG_FIRMWARE_TABLE=y # # Kernel hacking # # # printk and dmesg options # CONFIG_PRINTK_TIME=y # CONFIG_PRINTK_CALLER is not set # CONFIG_STACKTRACE_BUILD_ID is not set CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 CONFIG_CONSOLE_LOGLEVEL_QUIET=4 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 # CONFIG_BOOT_PRINTK_DELAY is not set CONFIG_DYNAMIC_DEBUG=y CONFIG_DYNAMIC_DEBUG_CORE=y # CONFIG_SYMBOLIC_ERRNAME is not set CONFIG_DEBUG_BUGVERBOSE=y # end of printk and dmesg options CONFIG_DEBUG_KERNEL=y CONFIG_DEBUG_MISC=y # # Compile-time checks and compiler options # CONFIG_DEBUG_INFO=y CONFIG_AS_HAS_NON_CONST_ULEB128=y # CONFIG_DEBUG_INFO_NONE is not set CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y # CONFIG_DEBUG_INFO_DWARF4 is not set # CONFIG_DEBUG_INFO_DWARF5 is not set # CONFIG_DEBUG_INFO_REDUCED is not set CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_COMPRESSED_ZSTD is not set # CONFIG_DEBUG_INFO_SPLIT is not set # CONFIG_DEBUG_INFO_BTF is not set CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y CONFIG_GDB_SCRIPTS=y CONFIG_FRAME_WARN=1024 # CONFIG_STRIP_ASM_SYMS is not set # CONFIG_READABLE_ASM is not set # CONFIG_HEADERS_INSTALL is not set # CONFIG_DEBUG_SECTION_MISMATCH is not set # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set # CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set CONFIG_OBJTOOL=y # CONFIG_VMLINUX_MAP is not set # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set # end of Compile-time checks and compiler options # # Generic Kernel Debugging Instruments # CONFIG_MAGIC_SYSRQ=y CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x01b6 CONFIG_MAGIC_SYSRQ_SERIAL=y CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE="" CONFIG_DEBUG_FS=y CONFIG_DEBUG_FS_ALLOW_ALL=y # CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set # CONFIG_DEBUG_FS_ALLOW_NONE is not set CONFIG_HAVE_ARCH_KGDB=y # CONFIG_KGDB is not set CONFIG_ARCH_HAS_UBSAN=y # CONFIG_UBSAN is not set CONFIG_HAVE_ARCH_KCSAN=y CONFIG_HAVE_KCSAN_COMPILER=y # end of Generic Kernel Debugging Instruments # # Networking Debugging # # CONFIG_NET_DEV_REFCNT_TRACKER is not set # CONFIG_NET_NS_REFCNT_TRACKER is not set CONFIG_DEBUG_NET=y # end of Networking Debugging # # Memory Debugging # CONFIG_PAGE_EXTENSION=y # CONFIG_DEBUG_PAGEALLOC is not set CONFIG_SLUB_DEBUG=y # CONFIG_SLUB_DEBUG_ON is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y CONFIG_PAGE_TABLE_CHECK_ENFORCED=y # CONFIG_PAGE_POISONING is not set # CONFIG_DEBUG_PAGE_REF is not set CONFIG_DEBUG_RODATA_TEST=y CONFIG_ARCH_HAS_DEBUG_WX=y # CONFIG_DEBUG_WX is not set CONFIG_GENERIC_PTDUMP=y CONFIG_PTDUMP_CORE=y CONFIG_PTDUMP_DEBUGFS=y CONFIG_HAVE_DEBUG_KMEMLEAK=y # CONFIG_DEBUG_KMEMLEAK is not set # CONFIG_PER_VMA_LOCK_STATS is not set # CONFIG_DEBUG_OBJECTS is not set # CONFIG_SHRINKER_DEBUG is not set # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_SCHED_STACK_END_CHECK is not set CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y # CONFIG_DEBUG_VM is not set # CONFIG_DEBUG_VM_PGTABLE is not set CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y # CONFIG_DEBUG_VIRTUAL is not set # CONFIG_DEBUG_MEMORY_INIT is not set # CONFIG_DEBUG_PER_CPU_MAPS is not set CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y # CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is not set # CONFIG_MEM_ALLOC_PROFILING is not set CONFIG_HAVE_ARCH_KASAN=y CONFIG_HAVE_ARCH_KASAN_VMALLOC=y CONFIG_CC_HAS_KASAN_GENERIC=y CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y CONFIG_KASAN=y CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX=y CONFIG_KASAN_GENERIC=y # CONFIG_KASAN_OUTLINE is not set CONFIG_KASAN_INLINE=y CONFIG_KASAN_STACK=y # CONFIG_KASAN_VMALLOC is not set # CONFIG_KASAN_KUNIT_TEST is not set # CONFIG_KASAN_MODULE_TEST is not set # CONFIG_KASAN_EXTRA_INFO is not set CONFIG_HAVE_ARCH_KFENCE=y # CONFIG_KFENCE is not set CONFIG_HAVE_ARCH_KMSAN=y # end of Memory Debugging # CONFIG_DEBUG_SHIRQ is not set # # Debug Oops, Lockups and Hangs # # CONFIG_PANIC_ON_OOPS is not set CONFIG_PANIC_ON_OOPS_VALUE=0 CONFIG_PANIC_TIMEOUT=0 # CONFIG_SOFTLOCKUP_DETECTOR is not set CONFIG_HAVE_HARDLOCKUP_DETECTOR_BUDDY=y # CONFIG_HARDLOCKUP_DETECTOR is not set CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y # CONFIG_DETECT_HUNG_TASK is not set # CONFIG_WQ_WATCHDOG is not set # CONFIG_WQ_CPU_INTENSIVE_REPORT is not set # CONFIG_TEST_LOCKUP is not set # end of Debug Oops, Lockups and Hangs # # Scheduler Debugging # CONFIG_SCHED_DEBUG=y CONFIG_SCHED_INFO=y CONFIG_SCHEDSTATS=y # end of Scheduler Debugging # CONFIG_DEBUG_TIMEKEEPING is not set # CONFIG_DEBUG_PREEMPT is not set # # Lock Debugging (spinlocks, mutexes, etc...) # CONFIG_LOCK_DEBUGGING_SUPPORT=y CONFIG_PROVE_LOCKING=y # CONFIG_PROVE_RAW_LOCK_NESTING is not set # CONFIG_LOCK_STAT is not set CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_MUTEXES=y CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y CONFIG_DEBUG_RWSEMS=y CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_LOCKDEP=y CONFIG_LOCKDEP_BITS=15 CONFIG_LOCKDEP_CHAINS_BITS=16 CONFIG_LOCKDEP_STACK_TRACE_BITS=19 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14 CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12 # CONFIG_DEBUG_LOCKDEP is not set CONFIG_DEBUG_ATOMIC_SLEEP=y # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set # CONFIG_LOCK_TORTURE_TEST is not set # CONFIG_WW_MUTEX_SELFTEST is not set # CONFIG_SCF_TORTURE_TEST is not set # CONFIG_CSD_LOCK_WAIT_DEBUG is not set # end of Lock Debugging (spinlocks, mutexes, etc...) CONFIG_TRACE_IRQFLAGS=y CONFIG_TRACE_IRQFLAGS_NMI=y # CONFIG_NMI_CHECK_CPU is not set # CONFIG_DEBUG_IRQFLAGS is not set CONFIG_STACKTRACE=y # CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set # CONFIG_DEBUG_KOBJECT is not set # # Debug kernel data structures # CONFIG_DEBUG_LIST=y # CONFIG_DEBUG_PLIST is not set # CONFIG_DEBUG_SG is not set # CONFIG_DEBUG_NOTIFIERS is not set # CONFIG_DEBUG_MAPLE_TREE is not set # end of Debug kernel data structures # # RCU Debugging # CONFIG_PROVE_RCU=y # CONFIG_RCU_SCALE_TEST is not set # CONFIG_RCU_TORTURE_TEST is not set # CONFIG_RCU_REF_SCALE_TEST is not set CONFIG_RCU_CPU_STALL_TIMEOUT=21 CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0 # CONFIG_RCU_CPU_STALL_CPUTIME is not set # CONFIG_RCU_TRACE is not set # CONFIG_RCU_EQS_DEBUG is not set # end of RCU Debugging # CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set CONFIG_CPU_HOTPLUG_STATE_CONTROL=y # CONFIG_LATENCYTOP is not set # CONFIG_DEBUG_CGROUP_REF is not set CONFIG_USER_STACKTRACE_SUPPORT=y CONFIG_NOP_TRACER=y CONFIG_HAVE_RETHOOK=y CONFIG_RETHOOK=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_DYNAMIC_FTRACE=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_FENTRY=y CONFIG_HAVE_OBJTOOL_MCOUNT=y CONFIG_HAVE_OBJTOOL_NOP_MCOUNT=y CONFIG_HAVE_C_RECORDMCOUNT=y CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y CONFIG_TRACER_MAX_TRACE=y CONFIG_TRACE_CLOCK=y CONFIG_RING_BUFFER=y CONFIG_EVENT_TRACING=y CONFIG_CONTEXT_SWITCH_TRACER=y CONFIG_RING_BUFFER_ALLOW_SWAP=y CONFIG_PREEMPTIRQ_TRACEPOINTS=y CONFIG_TRACING=y CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y CONFIG_FTRACE=y # CONFIG_BOOTTIME_TRACING is not set # CONFIG_FUNCTION_TRACER is not set # CONFIG_STACK_TRACER is not set CONFIG_IRQSOFF_TRACER=y # CONFIG_PREEMPT_TRACER is not set CONFIG_SCHED_TRACER=y CONFIG_HWLAT_TRACER=y CONFIG_OSNOISE_TRACER=y CONFIG_TIMERLAT_TRACER=y # CONFIG_MMIOTRACE is not set CONFIG_FTRACE_SYSCALLS=y CONFIG_TRACER_SNAPSHOT=y CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set # CONFIG_PROFILE_ALL_BRANCHES is not set CONFIG_BLK_DEV_IO_TRACE=y CONFIG_KPROBE_EVENTS=y CONFIG_UPROBE_EVENTS=y CONFIG_BPF_EVENTS=y CONFIG_DYNAMIC_EVENTS=y CONFIG_PROBE_EVENTS=y CONFIG_TRACING_MAP=y CONFIG_SYNTH_EVENTS=y CONFIG_USER_EVENTS=y CONFIG_HIST_TRIGGERS=y CONFIG_TRACE_EVENT_INJECT=y CONFIG_TRACEPOINT_BENCHMARK=y # CONFIG_RING_BUFFER_BENCHMARK is not set # CONFIG_TRACE_EVAL_MAP_FILE is not set # CONFIG_FTRACE_STARTUP_TEST is not set # CONFIG_RING_BUFFER_STARTUP_TEST is not set # CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set # CONFIG_PREEMPTIRQ_DELAY_TEST is not set # CONFIG_SYNTH_EVENT_GEN_TEST is not set # CONFIG_KPROBE_EVENT_GEN_TEST is not set # CONFIG_HIST_TRIGGERS_DEBUG is not set CONFIG_RV=y # CONFIG_RV_MON_WWNR is not set CONFIG_RV_REACTORS=y CONFIG_RV_REACT_PRINTK=y CONFIG_RV_REACT_PANIC=y # CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set # CONFIG_SAMPLES is not set CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y # CONFIG_STRICT_DEVMEM is not set # # x86 Debugging # CONFIG_X86_VERBOSE_BOOTUP=y CONFIG_EARLY_PRINTK=y # CONFIG_EARLY_PRINTK_DBGP is not set # CONFIG_EARLY_PRINTK_USB_XDBC is not set # CONFIG_EFI_PGT_DUMP is not set # CONFIG_DEBUG_TLBFLUSH is not set CONFIG_HAVE_MMIOTRACE_SUPPORT=y # CONFIG_X86_DECODER_SELFTEST is not set CONFIG_IO_DELAY_0X80=y # CONFIG_IO_DELAY_0XED is not set # CONFIG_IO_DELAY_UDELAY is not set # CONFIG_IO_DELAY_NONE is not set # CONFIG_DEBUG_BOOT_PARAMS is not set # CONFIG_CPA_DEBUG is not set # CONFIG_DEBUG_ENTRY is not set # CONFIG_DEBUG_NMI_SELFTEST is not set CONFIG_X86_DEBUG_FPU=y # CONFIG_PUNIT_ATOM_DEBUG is not set CONFIG_UNWINDER_ORC=y # CONFIG_UNWINDER_FRAME_POINTER is not set # end of x86 Debugging # # Kernel Testing and Coverage # CONFIG_KUNIT=y CONFIG_KUNIT_DEBUGFS=y CONFIG_KUNIT_FAULT_TEST=y CONFIG_KUNIT_TEST=y # CONFIG_KUNIT_EXAMPLE_TEST is not set # CONFIG_KUNIT_ALL_TESTS is not set CONFIG_KUNIT_DEFAULT_ENABLED=y # CONFIG_NOTIFIER_ERROR_INJECTION is not set # CONFIG_FUNCTION_ERROR_INJECTION is not set # CONFIG_FAULT_INJECTION is not set CONFIG_ARCH_HAS_KCOV=y CONFIG_CC_HAS_SANCOV_TRACE_PC=y # CONFIG_KCOV is not set CONFIG_RUNTIME_TESTING_MENU=y # CONFIG_TEST_DHRY is not set CONFIG_LKDTM=y # CONFIG_CPUMASK_KUNIT_TEST is not set # CONFIG_TEST_LIST_SORT is not set # CONFIG_TEST_MIN_HEAP is not set # CONFIG_TEST_SORT is not set # CONFIG_TEST_DIV64 is not set # CONFIG_TEST_IOV_ITER is not set # CONFIG_KPROBES_SANITY_TEST is not set # CONFIG_BACKTRACE_SELF_TEST is not set # CONFIG_TEST_REF_TRACKER is not set # CONFIG_RBTREE_TEST is not set # CONFIG_REED_SOLOMON_TEST is not set # CONFIG_INTERVAL_TREE_TEST is not set # CONFIG_PERCPU_TEST is not set # CONFIG_ATOMIC64_SELFTEST is not set # CONFIG_TEST_HEXDUMP is not set # CONFIG_STRING_KUNIT_TEST is not set # CONFIG_STRING_HELPERS_KUNIT_TEST is not set # CONFIG_TEST_KSTRTOX is not set # CONFIG_TEST_PRINTF is not set # CONFIG_TEST_SCANF is not set # CONFIG_TEST_BITMAP is not set # CONFIG_TEST_UUID is not set # CONFIG_TEST_XARRAY is not set # CONFIG_TEST_MAPLE_TREE is not set # CONFIG_TEST_RHASHTABLE is not set # CONFIG_TEST_IDA is not set # CONFIG_TEST_LKM is not set # CONFIG_TEST_BITOPS is not set # CONFIG_TEST_VMALLOC is not set # CONFIG_TEST_USER_COPY is not set # CONFIG_TEST_BPF is not set # CONFIG_TEST_BLACKHOLE_DEV is not set # CONFIG_FIND_BIT_BENCHMARK is not set # CONFIG_TEST_FIRMWARE is not set # CONFIG_TEST_SYSCTL is not set # CONFIG_BITFIELD_KUNIT is not set # CONFIG_CHECKSUM_KUNIT is not set # CONFIG_HASH_KUNIT_TEST is not set # CONFIG_RESOURCE_KUNIT_TEST is not set # CONFIG_SYSCTL_KUNIT_TEST is not set # CONFIG_LIST_KUNIT_TEST is not set # CONFIG_HASHTABLE_KUNIT_TEST is not set # CONFIG_LINEAR_RANGES_TEST is not set # CONFIG_CMDLINE_KUNIT_TEST is not set # CONFIG_BITS_TEST is not set # CONFIG_SLUB_KUNIT_TEST is not set # CONFIG_RATIONAL_KUNIT_TEST is not set # CONFIG_MEMCPY_KUNIT_TEST is not set # CONFIG_IS_SIGNED_TYPE_KUNIT_TEST is not set # CONFIG_OVERFLOW_KUNIT_TEST is not set # CONFIG_STACKINIT_KUNIT_TEST is not set # CONFIG_FORTIFY_KUNIT_TEST is not set # CONFIG_HW_BREAKPOINT_KUNIT_TEST is not set # CONFIG_SIPHASH_KUNIT_TEST is not set # CONFIG_TEST_UDELAY is not set # CONFIG_TEST_STATIC_KEYS is not set # CONFIG_TEST_DYNAMIC_DEBUG is not set # CONFIG_TEST_KMOD is not set # CONFIG_TEST_MEMCAT_P is not set # CONFIG_TEST_MEMINIT is not set # CONFIG_TEST_FREE_PAGES is not set # CONFIG_TEST_FPU is not set # CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set # CONFIG_TEST_OBJPOOL is not set CONFIG_ARCH_USE_MEMTEST=y # CONFIG_MEMTEST is not set # end of Kernel Testing and Coverage # # Rust hacking # # end of Rust hacking # end of Kernel hacking
On Fri, 19 Jul 2024 22:47:01 +0200 Mathias Krause <minipli@grsecurity.net> wrote: > Subject: [PATCH] eventfs: Don't return NULL in eventfs_create_dir() > > Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing > ei->dentry") added another check, testing if the parent was freed after > we released the mutex. If so, the function returns NULL. However, all > callers expect it to either return a valid pointer or an error pointer, > at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug > in event_subsystem_dir()"). Returning NULL will therefore fail the error > condition check in the caller. > > Fix this by substituting the NULL return value with a fitting error > pointer. > > Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") > Cc: Dan Carpenter <dan.carpenter@linaro.org> > Signed-off-by: Mathias Krause <minipli@grsecurity.net> This will not get into the workflow without being sent as a normal patch. Please send it and Cc those listed in MAINTAINERS (see get_maintainers.pl). -- Steve > --- > fs/tracefs/event_inode.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c > index 5d88c184f0fc..a9c28a1d5dc8 100644 > --- a/fs/tracefs/event_inode.c > +++ b/fs/tracefs/event_inode.c > @@ -736,7 +736,7 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode > /* Was the parent freed? */ > if (list_empty(&ei->list)) { > cleanup_ei(ei); > - ei = NULL; > + ei = ERR_PTR(-EBUSY); > } > return ei;
On Fri, 19 Jul 2024 22:47:01 +0200 Mathias Krause <minipli@grsecurity.net> wrote: > Beside the obvious bug, I noticed the following (not fixing the issue, > tho): > > diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c > index 5d88c184f0fc..687ad0a26458 100644 > --- a/fs/tracefs/event_inode.c > +++ b/fs/tracefs/event_inode.c > @@ -112,7 +112,7 @@ static void release_ei(struct kref *ref) > entry->release(entry->name, ei->data); > } > > - call_rcu(&ei->rcu, free_ei_rcu); > + call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu); > } This should be fixed too. Care to send a patch for this as well? It use to need RCU but then everything was switched over to SRCU. This was just leftover. > > static inline void put_ei(struct eventfs_inode *ei) > @@ -735,7 +735,9 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode > > /* Was the parent freed? */ > if (list_empty(&ei->list)) { > + mutex_lock(&eventfs_mutex); > cleanup_ei(ei); > + mutex_unlock(&eventfs_mutex); Why do you think this is needed? The ei is not on the list and has not been made visible. It was just allocated but the parent it was going to be attached to is about to be freed. > ei = NULL; > } > return ei; Thanks, -- Steve
On 23.07.24 16:43, Steven Rostedt wrote: > On Fri, 19 Jul 2024 22:47:01 +0200 > Mathias Krause <minipli@grsecurity.net> wrote: > >> Beside the obvious bug, I noticed the following (not fixing the issue, >> tho): >> >> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c >> index 5d88c184f0fc..687ad0a26458 100644 >> --- a/fs/tracefs/event_inode.c >> +++ b/fs/tracefs/event_inode.c >> @@ -112,7 +112,7 @@ static void release_ei(struct kref *ref) >> entry->release(entry->name, ei->data); >> } >> >> - call_rcu(&ei->rcu, free_ei_rcu); >> + call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu); >> } > > This should be fixed too. Care to send a patch for this as well? Sure, will do. > > It use to need RCU but then everything was switched over to SRCU. This was > just leftover. SRCU usage came up with commit 63940449555e ("eventfs: Implement eventfs lookup, read, open functions") and following, was further extended just to get almost completely nuked by [1] earlier this year. [1] https://lore.kernel.org/linux-trace-kernel/20240131184918.945345370@goodmis.org/ > >> >> static inline void put_ei(struct eventfs_inode *ei) >> @@ -735,7 +735,9 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode >> >> /* Was the parent freed? */ >> if (list_empty(&ei->list)) { >> + mutex_lock(&eventfs_mutex); >> cleanup_ei(ei); >> + mutex_unlock(&eventfs_mutex); > > Why do you think this is needed? The ei is not on the list and has not been > made visible. It was just allocated but the parent it was going to be > attached to is about to be freed. I have no strong understanding of the code, just reading into what the context told me the rules should be, which would be on one hand the following comment...: /* * The eventfs_inode (ei) itself is protected by SRCU. It is released from * its parent's list and will have is_freed set (under eventfs_mutex). * After the SRCU grace period is over and the last dput() is called * the ei is freed. */ ...and on the other the common pattern, mostly complying to the rule of first taking the eventfs_mutex, then checking 'is_freed' for a given ei -- supposedly implying, it can only be set under that very same mutex. As cleanup_ei() is just a glorified free_ei() which sets ei->is_freed to 1, I was implying the lack of taking eventfs_mutex is a bug. But looking further for the precondition, getting 'ei' unchained again after it was put to the parent's children list, I can find eventfs_remove_rec() which is only ever called under eventfs_mutex and does: list_del(&ei->list); free_ei(ei); So you're right and I wasn't paying close enough attention and got mislead by cleanup_ei() also setting ei->is_freed. But as it should already be 1 at that point, no bug here. Thanks, Mathias
On Mon, Jul 22, 2024 at 5:38 PM Mathias Krause <minipli@grsecurity.net> wrote: > > On 22.07.24 13:13, Ajay Kaher wrote: > > On Sat, Jul 20, 2024 at 2:17 AM Mathias Krause <minipli@grsecurity.net> wrote: > >> > >> I noticed, the user events ftrace selftest is crashing every now and > >> then in our automated tests. Digging into, I found that the following > >> is triggering the issue very reliable: > >> > >> - in one shell, as root: > >> # while true; do ./kselftest/user_events/ftrace_test; done > >> > >> - in a second shell, again as root: > >> # cd /sys/kernel/tracing > >> # while true; do cat events/user_events/__test_event/format; done 2>/dev/null > >> > > > > Tried to reproduced on 6.10.0-rc7-100.ph5+, only getting repeated output as: > Mathias, thanks for reporting. I am able to reproduce the 'KASAN: slab-use-after-free'. Steve, let me know if anything wrong in my investigation: [ 6264.339882] ================================================================== [ 6264.339970] BUG: KASAN: slab-use-after-free in f_start+0x2b5/0x370 This belongs to f_start() -> f_next() -> trace_get_fields(): trace_get_fields(struct trace_event_call *event_call) { if (!event_call->class->get_fields) return &event_call->class->fields; return event_call->class->get_fields(event_call); } This happens while reading 'events/user_events/__test_event/format'. Allocation: [ 6264.347212] Allocated by task 3287: [ 6264.348247] kasan_save_stack+0x26/0x50 [ 6264.348256] kasan_save_track+0x14/0x40 [ 6264.348260] kasan_save_alloc_info+0x37/0x50 [ 6264.348265] __kasan_kmalloc+0xb3/0xc0 [ 6264.348268] kmalloc_trace_noprof+0x168/0x330 [ 6264.348280] user_event_parse_cmd+0x57b/0x26c0 [ 6264.348286] user_events_ioctl+0xa92/0x1850 [ 6264.348290] __x64_sys_ioctl+0x138/0x1b0 [ 6264.348295] x64_sys_call+0x9a4/0x1f20 [ 6264.348299] do_syscall_64+0x4b/0x110 user_event_parse_cmd() -> user_event_parse() { . user = kzalloc(sizeof(*user), GFP_KERNEL_ACCOUNT); Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L2118 Freed: [ 6264.350333] kfree+0xd1/0x2b0 [ 6264.350337] destroy_user_event.part.0+0x313/0x450 [ 6264.350341] destroy_user_event+0x129/0x1a0 [ 6264.350344] delayed_destroy_user_event+0x62/0xd0 [ 6264.350347] process_one_work+0x621/0xf60 [ 6264.350359] worker_thread+0x760/0x14f0 static int destroy_user_event(struct user_event *user) { . kfree(user->call.print_fmt); kfree(EVENT_NAME(user)); kfree(user); <-- Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L1510 Race condition: Thread A i.e. event reader able to reach the f_start() as the path is valid. Thread A waiting for lock. At the sametime, Thread B has acquired lock and removing events entry followed by free the user_event object. Later once Thread A got the lock it tried to read address which belongs to struct trace_event_call (struct trace_event_call is member of struct user_event) Thread A (read event) Thread B (remove event) . worker_thread() . delayed_destroy_user_event() -> acquire event_mutex . destroy_user_event() vfs_read() . seq_read() . f_start() -> acquire event_mutex eventfs_remove_dir() . (waiting) kfree(user) . (waiting) released event_mutex acquired event_mutex f_next() trace_get_fields(): I think you have added the following check in f_start() to prevent this race condition, but somehow with eventfs still some gap to race condition. static void *f_start(struct seq_file *m, loff_t *pos) { mutex_lock(&event_mutex); if (!event_file_data(m->private)) <-- return ERR_PTR(-ENODEV); -Ajay
On Mon, Jul 22, 2024 at 5:38 PM Mathias Krause <minipli@grsecurity.net> wrote: > > On 22.07.24 13:13, Ajay Kaher wrote: > > On Sat, Jul 20, 2024 at 2:17 AM Mathias Krause <minipli@grsecurity.net> wrote: > >> > >> I noticed, the user events ftrace selftest is crashing every now and > >> then in our automated tests. Digging into, I found that the following > >> is triggering the issue very reliable: > >> > >> - in one shell, as root: > >> # while true; do ./kselftest/user_events/ftrace_test; done > >> > >> - in a second shell, again as root: > >> # cd /sys/kernel/tracing > >> # while true; do cat events/user_events/__test_event/format; done 2>/dev/null > >> > > > > Tried to reproduced on 6.10.0-rc7-100.ph5+, only getting repeated output as: < sending again after correcting alignments > Mathias, thanks for reporting. I am able to reproduce the 'KASAN: slab-use-after-free'. Steve, let me know if anything wrong in my investigation: [ 6264.339882] ================================================================== [ 6264.339970] BUG: KASAN: slab-use-after-free in f_start+0x2b5/0x370 This belongs to f_start() -> f_next() -> trace_get_fields(): trace_get_fields(struct trace_event_call *event_call) { if (!event_call->class->get_fields) return &event_call->class->fields; return event_call->class->get_fields(event_call); } This happens while reading 'events/user_events/__test_event/format'. Allocation: [ 6264.347212] Allocated by task 3287: [ 6264.348247] kasan_save_stack+0x26/0x50 [ 6264.348256] kasan_save_track+0x14/0x40 [ 6264.348260] kasan_save_alloc_info+0x37/0x50 [ 6264.348265] __kasan_kmalloc+0xb3/0xc0 [ 6264.348268] kmalloc_trace_noprof+0x168/0x330 [ 6264.348280] user_event_parse_cmd+0x57b/0x26c0 [ 6264.348286] user_events_ioctl+0xa92/0x1850 [ 6264.348290] __x64_sys_ioctl+0x138/0x1b0 [ 6264.348295] x64_sys_call+0x9a4/0x1f20 [ 6264.348299] do_syscall_64+0x4b/0x110 user_event_parse_cmd() -> user_event_parse() { . user = kzalloc(sizeof(*user), GFP_KERNEL_ACCOUNT); Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L2118 Freed: [ 6264.350333] kfree+0xd1/0x2b0 [ 6264.350337] destroy_user_event.part.0+0x313/0x450 [ 6264.350341] destroy_user_event+0x129/0x1a0 [ 6264.350344] delayed_destroy_user_event+0x62/0xd0 [ 6264.350347] process_one_work+0x621/0xf60 [ 6264.350359] worker_thread+0x760/0x14f0 static int destroy_user_event(struct user_event *user) { . kfree(user->call.print_fmt); kfree(EVENT_NAME(user)); kfree(user); <-- Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L1510 Race condition: Thread A i.e. event reader able to reach the f_start() as the path is valid. Thread A waiting for lock. At the sametime, Thread B has acquired lock and removing events entry followed by free the user_event object. Later once Thread A got the lock it tried to read address which belongs to struct trace_event_call (struct trace_event_call is member of struct user_event) Thread A (read event) Thread B (remove event) . worker_thread() . delayed_destroy_user_event() . -> acquire event_mutex . destroy_user_event() vfs_read() . seq_read() . f_start() -> acquire event_mutex eventfs_remove_dir() . (waiting) kfree(user) . (waiting) -> released event_mutex acquired event_mutex f_next() trace_get_fields(): I think you have added the following check in f_start() to prevent this race condition, but somehow with eventfs still some gap to race condition. static void *f_start(struct seq_file *m, loff_t *pos) { mutex_lock(&event_mutex); if (!event_file_data(m->private)) <-- return ERR_PTR(-ENODEV); -Ajay
On Thu, Jul 25, 2024 at 9:45 PM Ajay Kaher <ajay.kaher@broadcom.com> wrote: > > On Mon, Jul 22, 2024 at 5:38 PM Mathias Krause <minipli@grsecurity.net> wrote: > > > > On 22.07.24 13:13, Ajay Kaher wrote: > > > On Sat, Jul 20, 2024 at 2:17 AM Mathias Krause <minipli@grsecurity.net> wrote: > > >> > > >> I noticed, the user events ftrace selftest is crashing every now and > > >> then in our automated tests. Digging into, I found that the following > > >> is triggering the issue very reliable: > > >> > > >> - in one shell, as root: > > >> # while true; do ./kselftest/user_events/ftrace_test; done > > >> > > >> - in a second shell, again as root: > > >> # cd /sys/kernel/tracing > > >> # while true; do cat events/user_events/__test_event/format; done 2>/dev/null > > >> > > > > > > Tried to reproduced on 6.10.0-rc7-100.ph5+, only getting repeated output as: > > < sending again after correcting alignments > > > Mathias, thanks for reporting. I am able to reproduce the 'KASAN: > slab-use-after-free'. > > Steve, let me know if anything wrong in my investigation: > > [ 6264.339882] ================================================================== > [ 6264.339970] BUG: KASAN: slab-use-after-free in f_start+0x2b5/0x370 > > This belongs to f_start() -> f_next() -> trace_get_fields(): > > trace_get_fields(struct trace_event_call *event_call) > { > if (!event_call->class->get_fields) > return &event_call->class->fields; > return event_call->class->get_fields(event_call); > } > > This happens while reading 'events/user_events/__test_event/format'. > > > Allocation: > [ 6264.347212] Allocated by task 3287: > [ 6264.348247] kasan_save_stack+0x26/0x50 > [ 6264.348256] kasan_save_track+0x14/0x40 > [ 6264.348260] kasan_save_alloc_info+0x37/0x50 > [ 6264.348265] __kasan_kmalloc+0xb3/0xc0 > [ 6264.348268] kmalloc_trace_noprof+0x168/0x330 > [ 6264.348280] user_event_parse_cmd+0x57b/0x26c0 > [ 6264.348286] user_events_ioctl+0xa92/0x1850 > [ 6264.348290] __x64_sys_ioctl+0x138/0x1b0 > [ 6264.348295] x64_sys_call+0x9a4/0x1f20 > [ 6264.348299] do_syscall_64+0x4b/0x110 > > user_event_parse_cmd() -> user_event_parse() { > . > user = kzalloc(sizeof(*user), GFP_KERNEL_ACCOUNT); > > Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L2118 > > > Freed: > [ 6264.350333] kfree+0xd1/0x2b0 > [ 6264.350337] destroy_user_event.part.0+0x313/0x450 > [ 6264.350341] destroy_user_event+0x129/0x1a0 > [ 6264.350344] delayed_destroy_user_event+0x62/0xd0 > [ 6264.350347] process_one_work+0x621/0xf60 > [ 6264.350359] worker_thread+0x760/0x14f0 > > static int destroy_user_event(struct user_event *user) { > . > kfree(user->call.print_fmt); > kfree(EVENT_NAME(user)); > kfree(user); <-- > > Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L1510 > > > Race condition: > > Thread A i.e. event reader able to reach the f_start() as the path is > valid. Thread A waiting for lock. At the sametime, Thread B has > acquired lock and removing events entry followed by free the > user_event object. Later once Thread A got the lock it tried to read > address which belongs to struct trace_event_call (struct > trace_event_call is member of struct user_event) > > Thread A (read event) Thread B (remove event) > > . worker_thread() > . > delayed_destroy_user_event() > . -> > acquire event_mutex > . destroy_user_event() > vfs_read() . > seq_read() . > f_start() -> acquire event_mutex eventfs_remove_dir() > . (waiting) kfree(user) > . (waiting) -> released event_mutex > acquired event_mutex > f_next() > trace_get_fields(): > Thread A (read event) Thread B (remove event) . worker_thread() . delayed_destroy_user_event() . -> acquire event_mutex . destroy_user_event() vfs_read() . seq_read() . f_start() -> acquire event_mutex eventfs_remove_dir() . (waiting) kfree(user) . (waiting) -> released event_mutex acquired event_mutex f_next() trace_get_fields(): - Ajay > I think you have added the following check in f_start() to prevent > this race condition, but somehow with eventfs still some gap to race condition. > > static void *f_start(struct seq_file *m, loff_t *pos) { > mutex_lock(&event_mutex); > if (!event_file_data(m->private)) <-- > return ERR_PTR(-ENODEV); > > -Ajay
On Thu, 25 Jul 2024 21:45:03 +0530 Ajay Kaher <ajay.kaher@broadcom.com> wrote: > On Mon, Jul 22, 2024 at 5:38 PM Mathias Krause <minipli@grsecurity.net> wrote: > > > > On 22.07.24 13:13, Ajay Kaher wrote: > > > On Sat, Jul 20, 2024 at 2:17 AM Mathias Krause <minipli@grsecurity.net> wrote: > > >> > > >> I noticed, the user events ftrace selftest is crashing every now and > > >> then in our automated tests. Digging into, I found that the following > > >> is triggering the issue very reliable: > > >> > > >> - in one shell, as root: > > >> # while true; do ./kselftest/user_events/ftrace_test; done > > >> > > >> - in a second shell, again as root: > > >> # cd /sys/kernel/tracing > > >> # while true; do cat events/user_events/__test_event/format; done 2>/dev/null > > >> > > > > > > Tried to reproduced on 6.10.0-rc7-100.ph5+, only getting repeated output as: > > < sending again after correcting alignments > > > Mathias, thanks for reporting. I am able to reproduce the 'KASAN: > slab-use-after-free'. > > Steve, let me know if anything wrong in my investigation: Hi Ajay, Thanks for analyzing this. > > [ 6264.339882] ================================================================== > [ 6264.339970] BUG: KASAN: slab-use-after-free in f_start+0x2b5/0x370 > > This belongs to f_start() -> f_next() -> trace_get_fields(): > > trace_get_fields(struct trace_event_call *event_call) > { > if (!event_call->class->get_fields) > return &event_call->class->fields; > return event_call->class->get_fields(event_call); > } > > This happens while reading 'events/user_events/__test_event/format'. > > > Allocation: > [ 6264.347212] Allocated by task 3287: > [ 6264.348247] kasan_save_stack+0x26/0x50 > [ 6264.348256] kasan_save_track+0x14/0x40 > [ 6264.348260] kasan_save_alloc_info+0x37/0x50 > [ 6264.348265] __kasan_kmalloc+0xb3/0xc0 > [ 6264.348268] kmalloc_trace_noprof+0x168/0x330 > [ 6264.348280] user_event_parse_cmd+0x57b/0x26c0 > [ 6264.348286] user_events_ioctl+0xa92/0x1850 > [ 6264.348290] __x64_sys_ioctl+0x138/0x1b0 > [ 6264.348295] x64_sys_call+0x9a4/0x1f20 > [ 6264.348299] do_syscall_64+0x4b/0x110 > > user_event_parse_cmd() -> user_event_parse() { > . > user = kzalloc(sizeof(*user), GFP_KERNEL_ACCOUNT); > > Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L2118 > > > Freed: > [ 6264.350333] kfree+0xd1/0x2b0 > [ 6264.350337] destroy_user_event.part.0+0x313/0x450 > [ 6264.350341] destroy_user_event+0x129/0x1a0 > [ 6264.350344] delayed_destroy_user_event+0x62/0xd0 > [ 6264.350347] process_one_work+0x621/0xf60 > [ 6264.350359] worker_thread+0x760/0x14f0 > > static int destroy_user_event(struct user_event *user) { > . > kfree(user->call.print_fmt); > kfree(EVENT_NAME(user)); > kfree(user); <-- > > Link: https://elixir.bootlin.com/linux/v6.10/source/kernel/trace/trace_events_user.c#L1510 > > > Race condition: > > Thread A i.e. event reader able to reach the f_start() as the path is > valid. Thread A waiting for lock. At the sametime, Thread B has > acquired lock and removing events entry followed by free the > user_event object. Later once Thread A got the lock it tried to read > address which belongs to struct trace_event_call (struct > trace_event_call is member of struct user_event) > > Thread A (read event) Thread B (remove event) > > . worker_thread() > . > delayed_destroy_user_event() > . -> > acquire event_mutex > . destroy_user_event() > vfs_read() . > seq_read() . > f_start() -> acquire event_mutex eventfs_remove_dir() > . (waiting) kfree(user) > . (waiting) -> released event_mutex > acquired event_mutex > f_next() > trace_get_fields(): What really bothers me is that refcnt logic. I'm not sure if this is an issue, but the fact that you can inc the refcnt without holding the event_mutex looks wrong to me. I would guess it would WARN if that refcnt was incremented when zero, but there is a window where it gets set to 1 again. Too bad there's not a way to do a refcnt_set_if_zero() or something to atomically set the value but warn if it's not zero. But then again, if it did get incremented when zero, there should have been a warning then too. But I don't think that's causing this. Will look further. -- Steve > > I think you have added the following check in f_start() to prevent > this race condition, but somehow with eventfs still some gap to race condition. > > static void *f_start(struct seq_file *m, loff_t *pos) { > mutex_lock(&event_mutex); > if (!event_file_data(m->private)) <-- > return ERR_PTR(-ENODEV); > > -Ajay
On Thu, 25 Jul 2024 22:00:14 +0530 Ajay Kaher <ajay.kaher@broadcom.com> wrote: > Thread A (read event) Thread B (remove event) > > . worker_thread() > . delayed_destroy_user_event() > . -> acquire event_mutex > . destroy_user_event() > vfs_read() . > seq_read() . > f_start() -> acquire event_mutex eventfs_remove_dir() > . (waiting) kfree(user) > . (waiting) -> released event_mutex > acquired event_mutex > f_next() > trace_get_fields(): Hmm, I wonder if this would fix it? -- Steve diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c index 3a2b46847c8b..e9ed2826ff46 100644 --- a/kernel/trace/trace_events_user.c +++ b/kernel/trace/trace_events_user.c @@ -321,6 +321,8 @@ static void user_event_put(struct user_event *user, bool locked) */ refcount_set(&user->refcnt, 1); + user->call.data = NULL; + if (WARN_ON_ONCE(!schedule_work(&user->put_work))) { /* * If we fail we must wait for an admin to attempt delete or @@ -973,6 +975,11 @@ size_t copy_nofault(void *addr, size_t bytes, struct iov_iter *i) static struct list_head *user_event_get_fields(struct trace_event_call *call) { struct user_event *user = (struct user_event *)call->data; + static LIST_HEAD(head); + + /* If the user event is about to be deleted, return no fields */ + if (!user) + return &head; return &user->fields; }
On Thu, 25 Jul 2024 13:10:21 -0400 Steven Rostedt <rostedt@goodmis.org> wrote: > > diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c > index 3a2b46847c8b..e9ed2826ff46 100644 > --- a/kernel/trace/trace_events_user.c > +++ b/kernel/trace/trace_events_user.c > @@ -321,6 +321,8 @@ static void user_event_put(struct user_event *user, bool locked) > */ > refcount_set(&user->refcnt, 1); > > + user->call.data = NULL; Hmm, it may be possible to just have: user->call.get_fields = NULL; and then it will just use the call->class->fields instead and that should be initialized to empty. -- Steve > + > if (WARN_ON_ONCE(!schedule_work(&user->put_work))) { > /* > * If we fail we must wait for an admin to attempt delete or > @@ -973,6 +975,11 @@ size_t copy_nofault(void *addr, size_t bytes, struct iov_iter *i) > static struct list_head *user_event_get_fields(struct trace_event_call *call) > { > struct user_event *user = (struct user_event *)call->data; > + static LIST_HEAD(head); > + > + /* If the user event is about to be deleted, return no fields */ > + if (!user) > + return &head; > > return &user->fields; > }
On 25.07.24 19:16, Steven Rostedt wrote: > On Thu, 25 Jul 2024 13:10:21 -0400 > Steven Rostedt <rostedt@goodmis.org> wrote: >> >> diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c >> index 3a2b46847c8b..e9ed2826ff46 100644 >> --- a/kernel/trace/trace_events_user.c >> +++ b/kernel/trace/trace_events_user.c >> @@ -321,6 +321,8 @@ static void user_event_put(struct user_event *user, bool locked) >> */ >> refcount_set(&user->refcnt, 1); >> >> + user->call.data = NULL; > > Hmm, it may be possible to just have: > > user->call.get_fields = NULL; > > and then it will just use the call->class->fields instead and that should > be initialized to empty. Uhm, it's 'user' that has been free'd which makes all of the above reading/writing already free'd memory. So no, I don't think that'll fly. In fact, in our test environment with memory sanitation features enabled we saw that dereferencing 'class' in trace_get_fields() trapping (because the underlying object was free'd). > > -- Steve > > >> + >> if (WARN_ON_ONCE(!schedule_work(&user->put_work))) { >> /* >> * If we fail we must wait for an admin to attempt delete or >> @@ -973,6 +975,11 @@ size_t copy_nofault(void *addr, size_t bytes, struct iov_iter *i) >> static struct list_head *user_event_get_fields(struct trace_event_call *call) >> { >> struct user_event *user = (struct user_event *)call->data; Dereferencing a potentially free'd object, so 'user' is now "random" data. >> + static LIST_HEAD(head); >> + >> + /* If the user event is about to be deleted, return no fields */ >> + if (!user) >> + return &head; >> >> return &user->fields; >> } > Thanks, Mathias
On Thu, 25 Jul 2024 20:12:33 +0200 Mathias Krause <minipli@grsecurity.net> wrote: > > > > >> + > >> if (WARN_ON_ONCE(!schedule_work(&user->put_work))) { > >> /* > >> * If we fail we must wait for an admin to attempt delete or > >> @@ -973,6 +975,11 @@ size_t copy_nofault(void *addr, size_t bytes, struct iov_iter *i) > >> static struct list_head *user_event_get_fields(struct trace_event_call *call) > >> { > >> struct user_event *user = (struct user_event *)call->data; > > Dereferencing a potentially free'd object, so 'user' is now "random" data. This is the callback function of user->call.get_fields. That is, we have: user->call.get_fields = user_event_get_fields; And the f_start() code eventually calls trace_get_fields() that has (from a previous email in this thread). trace_get_fields(struct trace_event_call *event_call) { if (!event_call->class->get_fields) return &event_call->class->fields; return event_call->class->get_fields(event_call); } Where it calls the ->class->get_fields(event_call); that calls this function. By setting: user->call.get_fields = NULL; this will never get called and no random data will be accessed. That said, I was talking with Beau, we concluded that this shouldn't be the responsibility of the user of event call, and should be cleaned up by the event system. > > >> + static LIST_HEAD(head); > >> + > >> + /* If the user event is about to be deleted, return no fields */ > >> + if (!user) > >> + return &head; > >> > >> return &user->fields; > >> } Here's the proper fix: diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 6ef29eba90ce..3a2d2ff1625b 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -3140,8 +3140,10 @@ EXPORT_SYMBOL_GPL(trace_add_event_call); */ static void __trace_remove_event_call(struct trace_event_call *call) { + lockdep_assert_held(&event_mutex); event_remove(call); trace_destroy_fields(call); + call->get_fields = NULL; free_event_filter(call->filter); call->filter = NULL; } Can you try it out? -- Steve
On 25.07.24 21:05, Steven Rostedt wrote: > On Thu, 25 Jul 2024 20:12:33 +0200 > Mathias Krause <minipli@grsecurity.net> wrote: >>>> @@ -973,6 +975,11 @@ size_t copy_nofault(void *addr, size_t bytes, struct iov_iter *i) >>>> static struct list_head *user_event_get_fields(struct trace_event_call *call) >>>> { >>>> struct user_event *user = (struct user_event *)call->data; >> >> Dereferencing a potentially free'd object, so 'user' is now "random" data. > > This is the callback function of user->call.get_fields. > > That is, we have: > > user->call.get_fields = user_event_get_fields; > > And the f_start() code eventually calls trace_get_fields() that has (from a > previous email in this thread). > > trace_get_fields(struct trace_event_call *event_call) > { > if (!event_call->class->get_fields) > return &event_call->class->fields; > return event_call->class->get_fields(event_call); > } Right. But the point is, that 'event_call' is really some '&user->call'. With 'user' being free'd memory, what gives? Dereferencing 'event_call' is UB, so this function is doomed to fail because it cannot know if its only argument points to still valid memory or not. And that's the core issue -- calling that function for an object that's long gone -- the missing refcounting I hinted at in my first Email. > > Where it calls the ->class->get_fields(event_call); > > that calls this function. By setting: > > user->call.get_fields = NULL; > > this will never get called and no random data will be accessed. As 'user' is free'd or soon-to-be-free'd memory, that's a non-starter. > > That said, I was talking with Beau, we concluded that this shouldn't be the > responsibility of the user of event call, and should be cleaned up by the > event system. > > Here's the proper fix: > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > index 6ef29eba90ce..3a2d2ff1625b 100644 > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c > @@ -3140,8 +3140,10 @@ EXPORT_SYMBOL_GPL(trace_add_event_call); > */ > static void __trace_remove_event_call(struct trace_event_call *call) > { > + lockdep_assert_held(&event_mutex); > event_remove(call); > trace_destroy_fields(call); > + call->get_fields = NULL; > free_event_filter(call->filter); > call->filter = NULL; > } > > Can you try it out? I can try but I don't think that's the proper fix for above reasons, I'm sorry. Thanks, Mathias
On 25.07.24 21:05, Steven Rostedt wrote: > Here's the proper fix: > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > index 6ef29eba90ce..3a2d2ff1625b 100644 > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c > @@ -3140,8 +3140,10 @@ EXPORT_SYMBOL_GPL(trace_add_event_call); > */ > static void __trace_remove_event_call(struct trace_event_call *call) > { > + lockdep_assert_held(&event_mutex); > event_remove(call); > trace_destroy_fields(call); > + call->get_fields = NULL; That should be: + call->class->get_fields = NULL; > free_event_filter(call->filter); > call->filter = NULL; > } > > Can you try it out? Just tried, dies the same way, as expected. Thanks, Mathias
On Thu, 25 Jul 2024 21:42:41 +0200 Mathias Krause <minipli@grsecurity.net> wrote: > Right. But the point is, that 'event_call' is really some '&user->call'. > With 'user' being free'd memory, what gives? Dereferencing 'event_call' > is UB, so this function is doomed to fail because it cannot know if its > only argument points to still valid memory or not. And that's the core > issue -- calling that function for an object that's long gone -- the > missing refcounting I hinted at in my first Email. Ah, I missed that the call was part of the user structure. But I think I found the real fix. > > > > > Where it calls the ->class->get_fields(event_call); > > > > that calls this function. By setting: > > > > user->call.get_fields = NULL; > > > > this will never get called and no random data will be accessed. > > As 'user' is free'd or soon-to-be-free'd memory, that's a non-starter. > > > > > That said, I was talking with Beau, we concluded that this shouldn't be the > > responsibility of the user of event call, and should be cleaned up by the > > event system. > > > > Here's the proper fix: > > > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > > index 6ef29eba90ce..3a2d2ff1625b 100644 > > --- a/kernel/trace/trace_events.c > > +++ b/kernel/trace/trace_events.c > > @@ -3140,8 +3140,10 @@ EXPORT_SYMBOL_GPL(trace_add_event_call); > > */ > > static void __trace_remove_event_call(struct trace_event_call *call) > > { > > + lockdep_assert_held(&event_mutex); > > event_remove(call); > > trace_destroy_fields(call); > > + call->get_fields = NULL; Actually, this is wrong as it would be: call->class->get_fields, and this is not the right place to clear it, as class can be used by multiple calls. > > free_event_filter(call->filter); > > call->filter = NULL; > > } > > > > Can you try it out? > > I can try but I don't think that's the proper fix for above reasons, I'm > sorry. I believe the issue is that f_start() needs to check if the event file has been freed. New patch: diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 6ef29eba90ce..5fbfa1c885de 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -1627,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v) static void *f_start(struct seq_file *m, loff_t *pos) { + struct trace_event_file *file; void *p = (void *)FORMAT_HEADER; loff_t l = 0; /* ->stop() is called even if ->start() fails */ mutex_lock(&event_mutex); - if (!event_file_data(m->private)) + file = event_file_data(m->private); + if (!file || (file->flags & EVENT_FILE_FL_FREED)) return ERR_PTR(-ENODEV); while (l < *pos && p) -- Steve
On 25.07.24 22:15, Steven Rostedt wrote: > On Thu, 25 Jul 2024 21:42:41 +0200 > Mathias Krause <minipli@grsecurity.net> wrote: > >> Right. But the point is, that 'event_call' is really some '&user->call'. >> With 'user' being free'd memory, what gives? Dereferencing 'event_call' >> is UB, so this function is doomed to fail because it cannot know if its >> only argument points to still valid memory or not. And that's the core >> issue -- calling that function for an object that's long gone -- the >> missing refcounting I hinted at in my first Email. > > Ah, I missed that the call was part of the user structure. But I think I > found the real fix. > >> [...] > > I believe the issue is that f_start() needs to check if the event file has > been freed. > > New patch: > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > index 6ef29eba90ce..5fbfa1c885de 100644 > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c > @@ -1627,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v) > > static void *f_start(struct seq_file *m, loff_t *pos) > { > + struct trace_event_file *file; > void *p = (void *)FORMAT_HEADER; > loff_t l = 0; > > /* ->stop() is called even if ->start() fails */ > mutex_lock(&event_mutex); > - if (!event_file_data(m->private)) > + file = event_file_data(m->private); > + if (!file || (file->flags & EVENT_FILE_FL_FREED)) > return ERR_PTR(-ENODEV); > > while (l < *pos && p) > > Nope, still the same splats. Sorry, Mathias
On Thu, 25 Jul 2024 22:41:23 +0200 Mathias Krause <minipli@grsecurity.net> wrote: > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > > index 6ef29eba90ce..5fbfa1c885de 100644 > > --- a/kernel/trace/trace_events.c > > +++ b/kernel/trace/trace_events.c > > @@ -1627,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v) > > > > static void *f_start(struct seq_file *m, loff_t *pos) > > { > > + struct trace_event_file *file; > > void *p = (void *)FORMAT_HEADER; > > loff_t l = 0; > > > > /* ->stop() is called even if ->start() fails */ > > mutex_lock(&event_mutex); > > - if (!event_file_data(m->private)) > > + file = event_file_data(m->private); > > + if (!file || (file->flags & EVENT_FILE_FL_FREED)) > > return ERR_PTR(-ENODEV); > > > > while (l < *pos && p) > > > > > > Nope, still the same splats. Can you reshow the splats. Because I'm now confused. destroy_user_event() which is under event_mutex calls user_event_set_call_visible() with false, that will then call: trace_remove_event_call() -> probe_remove_event_call() -> __trace_remove_event_call() -> event_remove() -> remove_event_from_tracers() Where remove_event_from_tracers() loops over all the instances and will set each of the file pointers flags associated to the event: EVENT_FILE_FL_FREED Then it returns back to destroy_user_event() that would free the event. The f_start() that was in your crash, with the new patch, should take the event_mutex before referencing the event that was freed. And with that flag being set, it should exit out. Did you remove all the other patches before applying this one? -- Steve
On 25.07.24 23:14, Steven Rostedt wrote: > On Thu, 25 Jul 2024 22:41:23 +0200 > Mathias Krause <minipli@grsecurity.net> wrote: > >>> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c >>> index 6ef29eba90ce..5fbfa1c885de 100644 >>> --- a/kernel/trace/trace_events.c >>> +++ b/kernel/trace/trace_events.c >>> @@ -1627,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v) >>> >>> static void *f_start(struct seq_file *m, loff_t *pos) >>> { >>> + struct trace_event_file *file; >>> void *p = (void *)FORMAT_HEADER; >>> loff_t l = 0; >>> >>> /* ->stop() is called even if ->start() fails */ >>> mutex_lock(&event_mutex); >>> - if (!event_file_data(m->private)) >>> + file = event_file_data(m->private); >>> + if (!file || (file->flags & EVENT_FILE_FL_FREED)) >>> return ERR_PTR(-ENODEV); >>> >>> while (l < *pos && p) >>> >>> >> >> Nope, still the same splats. > > Can you reshow the splats. Because I'm now confused. Sure, see attached serial.log. That was for a single run of tools/testing/selftests/user_events/ftrace_test with the read loop of /sys/kernel/tracing/events/user_events/__test_event/format in a different shell. > > destroy_user_event() which is under event_mutex calls > user_event_set_call_visible() with false, that will then call: > > trace_remove_event_call() -> probe_remove_event_call() -> > __trace_remove_event_call() -> event_remove() -> > remove_event_from_tracers() > > Where remove_event_from_tracers() loops over all the instances and will set > each of the file pointers flags associated to the event: EVENT_FILE_FL_FREED > > Then it returns back to destroy_user_event() that would free the event. > > The f_start() that was in your crash, with the new patch, should take the > event_mutex before referencing the event that was freed. And with that flag > being set, it should exit out. Looking at the very first report: [ 76.306946] BUG: KASAN: slab-use-after-free in f_start+0x36e/0x3d0 That's what faddr2line gives me: f_start+0x36e/0x3d0: f_start at kernel/trace/trace_events.c:1637 (discriminator 1) Which is: 1635 mutex_lock(&event_mutex); 1636 file = event_file_data(m->private); 1637 if (!file || (file->flags & EVENT_FILE_FL_FREED)) 1638 return ERR_PTR(-ENODEV); Apparently, 'file' was free'd now and reading the 'flags' member triggers KASAN. Second report is: [ 76.367688] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0 which faddr2line says is: f_start+0x2e4/0x3d0: trace_get_fields at include/linux/trace_events.h:482 (inlined by) f_next at kernel/trace/trace_events.c:1545 (inlined by) f_start at kernel/trace/trace_events.c:1641 480 trace_get_fields(struct trace_event_call *event_call) 481 { 482 if (!event_call->class->get_fields) 483 return &event_call->class->fields; The one we ran into first. So still something doesn't match up with how lifetimes of objects are managed. > > Did you remove all the other patches before applying this one? Sure. That's what I have on top of v6.10: minipli@nuc:~/src/linux (tracefs)$ git diff v6.10 > ~/6.10-tracefs_dbg.diff Please ignore the WARN()s. They're left-overs from earlier debug attempts of mine. Thanks, Mathias
On Thu, 25 Jul 2024 23:32:30 +0200 Mathias Krause <minipli@grsecurity.net> wrote: > That was for a single run of > tools/testing/selftests/user_events/ftrace_test with the read loop of > /sys/kernel/tracing/events/user_events/__test_event/format in a > different shell. > > > > > destroy_user_event() which is under event_mutex calls > > user_event_set_call_visible() with false, that will then call: > > > > trace_remove_event_call() -> probe_remove_event_call() -> > > __trace_remove_event_call() -> event_remove() -> > > remove_event_from_tracers() > > > > Where remove_event_from_tracers() loops over all the instances and will set > > each of the file pointers flags associated to the event: EVENT_FILE_FL_FREED > > > > Then it returns back to destroy_user_event() that would free the event. > > > > The f_start() that was in your crash, with the new patch, should take the > > event_mutex before referencing the event that was freed. And with that flag > > being set, it should exit out. > > Looking at the very first report: > > [ 76.306946] BUG: KASAN: slab-use-after-free in f_start+0x36e/0x3d0 > > That's what faddr2line gives me: > > f_start+0x36e/0x3d0: > f_start at kernel/trace/trace_events.c:1637 (discriminator 1) > > Which is: > 1635 mutex_lock(&event_mutex); > 1636 file = event_file_data(m->private); > 1637 if (!file || (file->flags & EVENT_FILE_FL_FREED)) > 1638 return ERR_PTR(-ENODEV); BAH! I finally figured it out. I was able to reproduce it and this does stop the UAF from happening. The issue was, as a short cut, I had the "format" file's i_private point to the "call" entry directly, and not go via the "file". This is because the all format files are the same for the same "call", so no reason to differentiate them. The other files maintain state (like the "enable", "trigger", etc). But this means if the file were to disappear, the "format" file would be unaware of it. This should fix it for you. It fixed it for me. -- Steve diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 6ef29eba90ce..852643d957de 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -1540,7 +1540,8 @@ enum { static void *f_next(struct seq_file *m, void *v, loff_t *pos) { - struct trace_event_call *call = event_file_data(m->private); + struct trace_event_file *file = event_file_data(m->private); + struct trace_event_call *call = file->event_call; struct list_head *common_head = &ftrace_common_fields; struct list_head *head = trace_get_fields(call); struct list_head *node = v; @@ -1572,7 +1573,8 @@ static void *f_next(struct seq_file *m, void *v, loff_t *pos) static int f_show(struct seq_file *m, void *v) { - struct trace_event_call *call = event_file_data(m->private); + struct trace_event_file *file = event_file_data(m->private); + struct trace_event_call *call = file->event_call; struct ftrace_event_field *field; const char *array_descriptor; @@ -1627,12 +1629,14 @@ static int f_show(struct seq_file *m, void *v) static void *f_start(struct seq_file *m, loff_t *pos) { + struct trace_event_file *file; void *p = (void *)FORMAT_HEADER; loff_t l = 0; /* ->stop() is called even if ->start() fails */ mutex_lock(&event_mutex); - if (!event_file_data(m->private)) + file = event_file_data(m->private); + if (!file || (file->flags & EVENT_FILE_FL_FREED)) return ERR_PTR(-ENODEV); while (l < *pos && p) @@ -2485,7 +2489,6 @@ static int event_callback(const char *name, umode_t *mode, void **data, if (strcmp(name, "format") == 0) { *mode = TRACE_MODE_READ; *fops = &ftrace_event_format_fops; - *data = call; return 1; }
On 26.07.24 01:06, Steven Rostedt wrote: > On Thu, 25 Jul 2024 23:32:30 +0200 > Mathias Krause <minipli@grsecurity.net> wrote: > >> That was for a single run of >> tools/testing/selftests/user_events/ftrace_test with the read loop of >> /sys/kernel/tracing/events/user_events/__test_event/format in a >> different shell. >> >>> >>> destroy_user_event() which is under event_mutex calls >>> user_event_set_call_visible() with false, that will then call: >>> >>> trace_remove_event_call() -> probe_remove_event_call() -> >>> __trace_remove_event_call() -> event_remove() -> >>> remove_event_from_tracers() >>> >>> Where remove_event_from_tracers() loops over all the instances and will set >>> each of the file pointers flags associated to the event: EVENT_FILE_FL_FREED >>> >>> Then it returns back to destroy_user_event() that would free the event. >>> >>> The f_start() that was in your crash, with the new patch, should take the >>> event_mutex before referencing the event that was freed. And with that flag >>> being set, it should exit out. >> >> Looking at the very first report: >> >> [ 76.306946] BUG: KASAN: slab-use-after-free in f_start+0x36e/0x3d0 >> >> That's what faddr2line gives me: >> >> f_start+0x36e/0x3d0: >> f_start at kernel/trace/trace_events.c:1637 (discriminator 1) >> >> Which is: >> 1635 mutex_lock(&event_mutex); >> 1636 file = event_file_data(m->private); >> 1637 if (!file || (file->flags & EVENT_FILE_FL_FREED)) >> 1638 return ERR_PTR(-ENODEV); > > BAH! I finally figured it out. > > I was able to reproduce it and this does stop the UAF from happening. > > The issue was, as a short cut, I had the "format" file's i_private point to > the "call" entry directly, and not go via the "file". This is because the > all format files are the same for the same "call", so no reason to > differentiate them. The other files maintain state (like the "enable", > "trigger", etc). But this means if the file were to disappear, the "format" > file would be unaware of it. > > This should fix it for you. It fixed it for me. Heureka, it did! Thanks, Steve! > > -- Steve > > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > index 6ef29eba90ce..852643d957de 100644 > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c > @@ -1540,7 +1540,8 @@ enum { > > static void *f_next(struct seq_file *m, void *v, loff_t *pos) > { > - struct trace_event_call *call = event_file_data(m->private); > + struct trace_event_file *file = event_file_data(m->private); > + struct trace_event_call *call = file->event_call; > struct list_head *common_head = &ftrace_common_fields; > struct list_head *head = trace_get_fields(call); > struct list_head *node = v; > @@ -1572,7 +1573,8 @@ static void *f_next(struct seq_file *m, void *v, loff_t *pos) > > static int f_show(struct seq_file *m, void *v) > { > - struct trace_event_call *call = event_file_data(m->private); > + struct trace_event_file *file = event_file_data(m->private); > + struct trace_event_call *call = file->event_call; > struct ftrace_event_field *field; > const char *array_descriptor; > > @@ -1627,12 +1629,14 @@ static int f_show(struct seq_file *m, void *v) > > static void *f_start(struct seq_file *m, loff_t *pos) > { > + struct trace_event_file *file; > void *p = (void *)FORMAT_HEADER; > loff_t l = 0; > > /* ->stop() is called even if ->start() fails */ > mutex_lock(&event_mutex); > - if (!event_file_data(m->private)) > + file = event_file_data(m->private); > + if (!file || (file->flags & EVENT_FILE_FL_FREED)) > return ERR_PTR(-ENODEV); > > while (l < *pos && p) > @@ -2485,7 +2489,6 @@ static int event_callback(const char *name, umode_t *mode, void **data, > if (strcmp(name, "format") == 0) { > *mode = TRACE_MODE_READ; > *fops = &ftrace_event_format_fops; > - *data = call; > return 1; > } > Will ack the patch you send. Thanks again, Mathias
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 5d88c184f0fc..687ad0a26458 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -112,7 +112,7 @@ static void release_ei(struct kref *ref) entry->release(entry->name, ei->data); } - call_rcu(&ei->rcu, free_ei_rcu); + call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu); } static inline void put_ei(struct eventfs_inode *ei) @@ -735,7 +735,9 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode /* Was the parent freed? */ if (list_empty(&ei->list)) { + mutex_lock(&eventfs_mutex); cleanup_ei(ei); + mutex_unlock(&eventfs_mutex); ei = NULL; } return ei; The s/call_rcu/call_srcu/ one is because not only do the comments talk about SRCU protection, the code does so as well, e.g. eventfs_iterate(). Similar argumentation for taking the mutex around cleanup_ei(). It sets the 'is_freed' member which others expect only to be set -- or at least to have a stable value -- when the mutex is hold. As 'ei' was exposed to its parent before, it may have escaped to other users, e.g. via eventfs_iterate(). I may have missed something, painting these changes completely void, therefore spared me the time to do proper patches. However, below one is legit ("git am --scissors ..." yada yada): ---8<--- Subject: [PATCH] eventfs: Don't return NULL in eventfs_create_dir() Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") added another check, testing if the parent was freed after we released the mutex. If so, the function returns NULL. However, all callers expect it to either return a valid pointer or an error pointer, at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug in event_subsystem_dir()"). Returning NULL will therefore fail the error condition check in the caller. Fix this by substituting the NULL return value with a fitting error pointer. Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") Cc: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Mathias Krause <minipli@grsecurity.net> --- fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 5d88c184f0fc..a9c28a1d5dc8 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -736,7 +736,7 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode /* Was the parent freed? */ if (list_empty(&ei->list)) { cleanup_ei(ei); - ei = NULL; + ei = ERR_PTR(-EBUSY); } return ei; }
Hi Steven, Ajay, [ @Cc list: I found out issues with tracefs have been reported / attempted to get fixed in the past, so you may be interested. ] I noticed, the user events ftrace selftest is crashing every now and then in our automated tests. Digging into, I found that the following is triggering the issue very reliable: - in one shell, as root: # while true; do ./kselftest/user_events/ftrace_test; done - in a second shell, again as root: # cd /sys/kernel/tracing # while true; do cat events/user_events/__test_event/format; done 2>/dev/null Ignoring that the selftest fails for half of its tests -- which is a regression and therefore yet another bug, I guess -- this triggers an access fault (GFP/PF/NULL deref) after a few iterations, usually within a minute, mostly mere seconds. With KASAN enabled it generates a splat almost instantly, like following: [ 23.790955] ================================================================== [ 23.791692] BUG: KASAN: slab-use-after-free in f_show+0x43b/0x470 [ 23.792244] Read of size 8 at addr ffff888007076878 by task cat/755 [ 23.792753] [ 23.792947] CPU: 1 PID: 755 Comm: cat Tainted: G D N 6.10.0-vanilla-dirty #30 [ 23.793563] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 23.794280] Call Trace: [ 23.794470] <TASK> [ 23.794642] dump_stack_lvl+0x66/0xa0 [ 23.794909] print_report+0xd0/0x630 [ 23.795180] ? f_show+0x43b/0x470 [ 23.795415] ? __virt_addr_valid+0x208/0x3f0 [ 23.795700] ? f_show+0x43b/0x470 [ 23.795935] kasan_report+0xd8/0x110 [ 23.796183] ? f_show+0x43b/0x470 [ 23.796418] f_show+0x43b/0x470 [ 23.796645] seq_read_iter+0x418/0x11e0 [ 23.796907] ? __page_table_check_ptes_set+0x166/0x1a0 [ 23.797280] seq_read+0x261/0x350 [ 23.797537] ? lock_release+0x453/0x600 [ 23.797819] ? __pfx_seq_read+0x10/0x10 [ 23.798103] ? set_ptes.isra.0+0x11b/0x150 [ 23.798402] vfs_read+0x171/0x9e0 [ 23.798657] ? lock_acquire+0x408/0x4b0 [ 23.798970] ? __pfx_vfs_read+0x10/0x10 [ 23.799267] ? lock_release+0x453/0x600 [ 23.799549] ? do_user_addr_fault+0x45b/0x8b0 [ 23.799862] ? __pfx_lock_release+0x10/0x10 [ 23.800162] ? __pfx___up_read+0x10/0x10 [ 23.800448] ksys_read+0xdd/0x1a0 [ 23.800704] ? __pfx_ksys_read+0x10/0x10 [ 23.801007] ? do_user_addr_fault+0x465/0x8b0 [ 23.801341] do_syscall_64+0x66/0x130 [ 23.801615] entry_SYSCALL_64_after_hwframe+0x71/0x79 [ 23.801959] RIP: 0033:0x7f1fdb9df40e [ 23.802230] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 [ 23.803352] RSP: 002b:00007fff86d62658 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 23.803848] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f1fdb9df40e [ 23.804302] RDX: 0000000000020000 RSI: 00007f1fdb8d3000 RDI: 0000000000000003 [ 23.804753] RBP: 00007f1fdb8d3000 R08: 00007f1fdb8d2010 R09: 0000000000000000 [ 23.805239] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000 [ 23.805694] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [ 23.806153] </TASK> [ 23.806352] [ 23.806518] Allocated by task 753: [ 23.806781] kasan_save_stack+0x20/0x40 [ 23.807094] kasan_save_track+0x14/0x30 [ 23.807377] __kasan_kmalloc+0x8f/0xa0 [ 23.807656] user_event_parse_cmd+0x590/0x25e0 [ 23.807969] user_events_ioctl+0xa52/0x17f0 [ 23.808267] __x64_sys_ioctl+0x133/0x190 [ 23.808555] do_syscall_64+0x66/0x130 [ 23.808830] entry_SYSCALL_64_after_hwframe+0x71/0x79 [ 23.809208] [ 23.809370] Freed by task 58: [ 23.809609] kasan_save_stack+0x20/0x40 [ 23.809890] kasan_save_track+0x14/0x30 [ 23.810173] kasan_save_free_info+0x3b/0x60 [ 23.810473] poison_slab_object+0x10a/0x170 [ 23.810771] __kasan_slab_free+0x14/0x30 [ 23.811090] kfree+0xe0/0x2f0 [ 23.811338] destroy_user_event+0x305/0x450 [ 23.811639] delayed_destroy_user_event+0x5c/0xe0 [ 23.811965] process_one_work+0x81c/0x1970 [ 23.812259] worker_thread+0x608/0x1160 [ 23.812542] kthread+0x2be/0x3b0 [ 23.812794] ret_from_fork+0x2c/0x70 [ 23.813098] ret_from_fork_asm+0x1a/0x30 [ 23.813387] [ 23.813551] Last potentially related work creation: [ 23.813885] kasan_save_stack+0x20/0x40 [ 23.814168] __kasan_record_aux_stack+0x8e/0xa0 [ 23.814489] insert_work+0x20/0x1b0 [ 23.814756] __queue_work+0x67a/0xc60 [ 23.815079] queue_work_on+0x63/0x90 [ 23.815350] user_event_put+0x1f9/0x390 [ 23.815631] user_events_ioctl+0x11ed/0x17f0 [ 23.815935] __x64_sys_ioctl+0x133/0x190 [ 23.816223] do_syscall_64+0x66/0x130 [ 23.816498] entry_SYSCALL_64_after_hwframe+0x71/0x79 [ 23.816841] [ 23.817019] The buggy address belongs to the object at ffff888007076800 [ 23.817019] which belongs to the cache kmalloc-cg-512 of size 512 [ 23.817799] The buggy address is located 120 bytes inside of [ 23.817799] freed 512-byte region [ffff888007076800, ffff888007076a00) [ 23.818530] [ 23.818694] The buggy address belongs to the physical page: [ 23.819092] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7074 [ 23.819602] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.820323] memcg:ffff88800277fd01 [ 23.820595] anon flags: 0x40(head|zone=0) [ 23.820885] page_type: 0xffffefff(slab) [ 23.821203] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 0000000000000001 [ 23.821706] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff88800277fd01 [ 23.822206] head: 0000000000000040 ffff88800014cdc0 0000000000000000 0000000000000001 [ 23.822711] head: 0000000000000000 0000000080100010 00000001ffffefff ffff88800277fd01 [ 23.823261] head: 0000000000000002 ffffea00001c1d01 ffffffffffffffff 0000000000000000 [ 23.823764] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 23.824271] page dumped because: kasan: bad access detected [ 23.824638] [ 23.824799] Memory state around the buggy address: [ 23.825162] ffff888007076700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.825641] ffff888007076780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.826116] >ffff888007076800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.826588] ^ [ 23.827070] ffff888007076880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.827545] ffff888007076900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.828018] ================================================================== I did a bisect run and ended up on commit 27152bceea1d ("eventfs: Move tracing/events to eventfs"). This is, of cause, only the enabling commit. The bug is likely in one of the preceeding commits introducing eventfs infrastructure. The git bisect log (I jumped around a little in the beginning, but yeah, v6.10 is still broken): git bisect start # status: waiting for both good and bad commits # bad: [a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6] Linux 6.9 git bisect bad a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 # status: waiting for good commit(s), bad commit known # bad: [0c3836482481200ead7b416ca80c68a29cfdaabd] Linux 6.10 git bisect bad 0c3836482481200ead7b416ca80c68a29cfdaabd # status: waiting for good commit(s), bad commit known # bad: [ffc253263a1375a65fa6c9f62a893e9767fbebfa] Linux 6.6 git bisect bad ffc253263a1375a65fa6c9f62a893e9767fbebfa # status: waiting for good commit(s), bad commit known # good: [6995e2de6891c724bfeb2db33d7b87775f913ad1] Linux 6.4 git bisect good 6995e2de6891c724bfeb2db33d7b87775f913ad1 # good: [692f5510159c79bfa312a4e27a15e266232bfb4c] Merge tag 'asoc-v6.6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus git bisect good 692f5510159c79bfa312a4e27a15e266232bfb4c # good: [0e72db77672ff4758a31fb5259c754a7bb229751] Merge tag 'soc-dt-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc git bisect good 0e72db77672ff4758a31fb5259c754a7bb229751 # bad: [5eea5820c7340d39e56e169e1b87199391105f6b] Merge tag 'mm-stable-2023-09-04-14-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm git bisect bad 5eea5820c7340d39e56e169e1b87199391105f6b # good: [28a4f91f5f251689c69155bc6a0b1afc9916c874] Merge tag 'driver-core-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core git bisect good 28a4f91f5f251689c69155bc6a0b1afc9916c874 # bad: [f7e97ce26972ae7be8bbbae8d819ff311d4c5900] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma git bisect bad f7e97ce26972ae7be8bbbae8d819ff311d4c5900 # good: [9a5d660fdb25d20748d7f9e9559c86073c3bb368] media: ivsc: Add ACPI dependency git bisect good 9a5d660fdb25d20748d7f9e9559c86073c3bb368 # good: [704e2c6107f1a5353a1038bac137dda0df2a6dd0] Merge tag 'icc-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next git bisect good 704e2c6107f1a5353a1038bac137dda0df2a6dd0 # good: [bd30fe6a7d9b72e73c5ac9109cbc3066dde08034] Merge tag 'wq-for-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq git bisect good bd30fe6a7d9b72e73c5ac9109cbc3066dde08034 # good: [d952f54d01ec2ea5ee9d5e21f2ea3a5807b4bcbc] RDMA/hns: Remove unused declaration hns_roce_modify_srq() git bisect good d952f54d01ec2ea5ee9d5e21f2ea3a5807b4bcbc # bad: [34232fcfe9a383bea802af682baae5c99f22376c] Merge tag 'trace-v6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace git bisect bad 34232fcfe9a383bea802af682baae5c99f22376c # bad: [7c1130ea5cae215588e6d51242b877fd405e6c32] test: ftrace: Fix kprobe test for eventfs git bisect bad 7c1130ea5cae215588e6d51242b877fd405e6c32 # good: [5bdcd5f5331a276a3ddf1fba8605986d0d15298a] eventfs: Implement removal of meta data from eventfs git bisect good 5bdcd5f5331a276a3ddf1fba8605986d0d15298a # bad: [27152bceea1df27ffebb12ac9cd9adbf2c4c3f35] eventfs: Move tracing/events to eventfs git bisect bad 27152bceea1df27ffebb12ac9cd9adbf2c4c3f35 # first bad commit: [27152bceea1df27ffebb12ac9cd9adbf2c4c3f35] eventfs: Move tracing/events to eventfs I stared quite hard at the inode/dentry/file handling and, imho, it's quite broken as it leaks pointers to refcounted objects which may go away anytime, e.g. &user->call via trace_add_event_call() in user_event_set_call_visible(). That'll lead to a user reachable file hierarchy below events/user_events/$eventname/ that isn't bound to the creator's mm. Assume one process opens events/user_events/$eventname/format, then the walked fields -- the whole object, actually -- may go away anytime, once the creator either removes the user probe again or closes its fd to /sys/kernel/tracing/user_events_data, leading to user_events_release() doing the final user_event_put() leading to object destruction. The concurrent reader of events/user_events/$eventname/format will now operate on a free'd object. Boom! As mentioned, I stared quite hard at the code and tried to fix it via numerous ways but the core issue is, imho, the lack of refcounting the &user->call object, or even better, 'user', for the files created below events/user_events/$eventname/. However, I found no easy way to do that. My hopes are, you may be able to, now that there's an easy reproducer. Beside the obvious bug, I noticed the following (not fixing the issue, tho): --->8--- Thanks, Mathias