From 4b4d376b49243815ce7b3029a7dd0c84032159de Mon Sep 17 00:00:00 2001 From: Sultan Alsawaf Date: Sat, 18 Oct 2025 18:58:18 -0700 Subject: [PATCH 1/2] kernel: Fix mayhem caused by clearing unrelated thread info flags In disable_seccomp(), the line responsible for clearing the TIF_SECCOMP bit from the current task's thread info flags erroneously treats TIF_SECCOMP as a bit mask and clears it in addition to the actual bit mask, _TIF_SECCOMP. TIF_SECCOMP is a bit number, while _TIF_SECCOMP is the bit mask corresponding to that bit number. As a result, this clears multiple unrelated thread info flags in addition to the TIF_SECCOMP flag. On arm64, TIF_SECCOMP is defined as decimal number 11, which translates to 0b1011 in binary. That is the same as BIT(0)|BIT(1)|BIT(3). Since those are the unrelated bits that are cleared, that means the following flags are spuriously cleared on arm64: TIF_SIGPENDING, TIF_NEED_RESCHED, and TIF_FOREIGN_FPSTATE. When TIF_FOREIGN_FPSTATE is spuriously cleared, it means that fpsimd_save() won't be skipped when there is a context switch triggered by involuntary preemption (via interrupt) from within kernel context. And since there is no fpsimd state saved when fpsimd_save() runs in this scenario, there is a NULL pointer dereference kernel panic as a result: [ 33.115229] KernelSU: sys_execve su found [ 33.115636] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 33.115644] Mem abort info: [ 33.115647] ESR = 0x0000000096000046 [ 33.115651] EC = 0x25: DABT (current EL), IL = 32 bits [ 33.115656] SET = 0, FnV = 0 [ 33.115660] EA = 0, S1PTW = 0 [ 33.115664] FSC = 0x06: level 2 translation fault [ 33.115668] Data abort info: [ 33.115671] ISV = 0, ISS = 0x00000046 [ 33.115675] CM = 0, WnR = 1 [ 33.115678] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000b81bf6000 [ 33.115683] [0000000000000000] pgd=0800000b80c50003, p4d=0800000b80c50003, pud=0800000b80c50003, pmd=0000000000000000 [ 33.115697] Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP [ 33.115709] debug-snapshot dss: context saved(CPU:2) [ 33.116002] item - log_kevents is disabled [ 33.116019] CPU: 2 PID: 9119 Comm: androidx.work-2 Tainted: G S W 6.1.156-NeutrinoKernel #1 [ 33.116025] Hardware name: ZUMA PRO COMET MP board based on ZUMA PRO (DT) [ 33.116031] pstate: 224000c5 (nzCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 33.116037] pc : fpsimd_save_state+0x4/0x58 [ 33.116052] lr : fpsimd_save.lto_priv.0+0xe0/0x110 [ 33.116062] sp : ffffff88289f3a10 [ 33.116065] x29: ffffff88289f3a10 x28: ffffff88291ff000 x27: 0000007fd07b29f2 [ 33.116075] x26: ffffff88291ff5a8 x25: 0000000000000000 x24: ffffffd63b8f0000 [ 33.116084] x23: ffffffd63b8f49c8 x22: ffffff800953a598 x21: ffffff8b7fccb340 [ 33.116093] x20: ffffffb5443db000 x19: ffffffd63b8f0340 x18: ffffff8b7fcd7440 [ 33.116102] x17: 0000000000000000 x16: 0000000000000001 x15: ffffffd63bb40000 [ 33.116110] x14: 0000000000000214 x13: 0000000000000203 x12: ffffff8002e4d400 [ 33.116119] x11: 0000000000000000 x10: 0000000000000011 x9 : 00000000000000c0 [ 33.116128] x8 : 0000000000005c45 x7 : 00000000001731c2 x6 : 0000000762585000 [ 33.116137] x5 : 0000000000000000 x4 : 0000000b46387000 x3 : 0000000000000001 [ 33.116145] x2 : 0000000000000000 x1 : 0000000004000000 x0 : 0000000000000000 [ 33.116154] Call trace: [ 33.116158] fpsimd_save_state+0x4/0x58 [ 33.116165] __schedule.lto_priv.0+0x410/0xf40 [ 33.116172] preempt_schedule_irq+0x44/0x80 [ 33.116178] el1_interrupt+0xc4/0x178 [ 33.116186] el1h_64_irq_handler+0x18/0x20 [ 33.116193] el1h_64_irq+0x64/0x68 [ 33.116199] strnlen_user.lto_priv.0+0xe0/0x1a0 [ 33.116209] do_execveat_common+0x1bc/0x24c [ 33.116216] __arm64_sys_execve.lto_priv.0+0xb4/0x1e8 [ 33.116221] invoke_syscall.constprop.0+0x54/0xe0 [ 33.116230] el0_svc+0x228/0x340 [ 33.116237] el0t_64_sync_handler+0x110/0x11c [ 33.116245] el0t_64_sync+0x170/0x174 [ 33.116253] Code: d518212a d5033fdf d53cd051 d503245f (ad000400) [ 33.116257] ---[ end trace 0000000000000000 ]--- Note the `[ 33.115229] KernelSU: sys_execve su found` message immediately preceding the panic. Fix this mayhem by removing TIF_SECCOMP from the bitwise negation for clearing the seccomp flag, since it should only be using _TIF_SECCOMP. Signed-off-by: Sultan Alsawaf --- kernel/core_hook.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/core_hook.c b/kernel/core_hook.c index b0cbfcaa1070..9dd53dc48854 100644 --- a/kernel/core_hook.c +++ b/kernel/core_hook.c @@ -119,7 +119,7 @@ static void disable_seccomp() LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0) current_thread_info()->syscall_work &= ~SYSCALL_WORK_SECCOMP; #else - current_thread_info()->flags &= ~(TIF_SECCOMP | _TIF_SECCOMP); + current_thread_info()->flags &= ~_TIF_SECCOMP; #endif #ifdef CONFIG_SECCOMP From f7314fc33a0230ec7ddf3ab454a1618210d61401 Mon Sep 17 00:00:00 2001 From: Sultan Alsawaf Date: Sat, 18 Oct 2025 19:24:04 -0700 Subject: [PATCH 2/2] kernel: Fix missing atomicity when clearing seccomp thread info flag Thread info flags as well as syscall_work flags must be manipulated atomically. Since disable_seccomp() doesn't atomically clear the seccomp flag, this can result in the loss of an intermediary write into the flag mask in between when the current flag mask is read and then the modified flag mask is written. Losing thread info flag writes can lead to unexpected bugs and kernel panics. Fix this by using the proper helpers to atomically clear the seccomp flag. Signed-off-by: Sultan Alsawaf --- kernel/core_hook.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/core_hook.c b/kernel/core_hook.c index 9dd53dc48854..c7ed67d40188 100644 --- a/kernel/core_hook.c +++ b/kernel/core_hook.c @@ -117,9 +117,9 @@ static void disable_seccomp() // disable seccomp #if defined(CONFIG_GENERIC_ENTRY) && \ LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0) - current_thread_info()->syscall_work &= ~SYSCALL_WORK_SECCOMP; + clear_syscall_work(SECCOMP); #else - current_thread_info()->flags &= ~_TIF_SECCOMP; + clear_thread_flag(TIF_SECCOMP); #endif #ifdef CONFIG_SECCOMP