2025년 3월 27일부터 AOSP를 빌드하고 기여하려면 aosp-main 대신 android-latest-release를 사용하는 것이 좋습니다. 자세한 내용은 AOSP 변경사항을 참고하세요.
GKI 16-6.12 android-mainline 오류 수정사항
컬렉션을 사용해 정리하기
내 환경설정을 기준으로 콘텐츠를 저장하고 분류하세요.
이 페이지에서는 android-mainline에서 발견되었으며 파트너에게 중요한 수정사항과 중요한 문제를 설명합니다.
2024년 11월 15일
2024년 11월 1일
- Linux 6.12-rc4 도착
- 요약:
CONFIG_OF_DYNAMIC가 결함이 있는 드라이버의 심각한 회귀를 일으킬 수 있습니다.
- 세부정보: Linux
6.12-rc1를 android-mainline에 병합하는 동안 트리 외부 드라이버가 로드되지 않는 문제가 발견되었습니다. 드라이버 버그를 노출한 변경사항은 커밋 274aff8711b2 ("clk: Add
KUnit tests for clks registered with struct clk_parent_data")로 식별되었으며 aosp/3287735에서 일시적으로 되돌렸습니다.
변경사항으로 인해 CONFIG_OF_OVERLAY이 선택되고 CONFIG_OF_DYNAMIC이 선택됩니다.
!OF_DYNAMIC를 사용하면 of_node_get() 및 of_node_put()가 noops로 구현되므로 참조 수가 효과적으로 사용 중지됩니다. OF_DYNAMIC를 다시 사용 설정하면 struct device_node의 참조 수를 잘못 구현하는 드라이버의 문제가 노출됩니다. 이로 인해 메모리 손상, use-after-free, 메모리 누수와 같은 다양한 유형의 오류가 발생합니다.
- OF 파싱 관련 API의 모든 사용은 검사해야 합니다. 다음 목록은 일부 목록이지만 지금까지 관찰된 사례가 포함되어 있습니다.
- Use after free (UAF):
- 동일한
device_node 인수 재사용: 이러한 함수는 주어진 노드에서 of_node_put()를 호출하므로 호출하기 전에 of_node_get()를 추가해야 할 수 있습니다 (예: 동일한 노드를 인수로 사용하여 반복적으로 호출하는 경우).
of_find_compatible_node()of_find_node_by_name()of_find_node_by_path()of_find_node_by_type()of_get_next_cpu_node()of_get_next_parent()of_get_next_child()of_get_next_available_child()of_get_next_reserved_child()of_find_node_with_property()of_find_matching_node_and_match()
- 특정 루프에서 종료 유형이 발생한 후
device_node 사용:
for_each_available_child_of_node_scoped()for_each_available_child_of_node()for_each_child_of_node_scoped()for_each_child_of_node()
- 다음과 같이
device_node의 char * 속성에 대한 직접 포인터를 유지합니다.
const char *foo = struct device_node::nameof_property_read_string()of_property_read_string_array()of_property_read_string_index()of_get_property()
- 메모리 누수:
device_node를 가져오고 이를 참조 해제하는 것을 잊어버림 (of_node_put()). 이러한 노드에서 반환된 노드는 특정 시점에 해제되어야 합니다.
of_find_compatible_node()of_find_node_by_name()of_find_node_by_path()of_find_node_by_type()of_find_node_by_phandle()of_parse_phandle()of_find_node_opts_by_path()of_get_next_cpu_node()of_get_compatible_child()of_get_child_by_name()of_get_parent()of_get_next_parent()of_get_next_child()of_get_next_available_child()of_get_next_reserved_child()of_find_node_with_property()of_find_matching_node_and_match()
- 루프 반복에서
device_node를 유지합니다. 다음 내에서 반환하거나 중단하는 경우 어느 시점에서든 나머지 참조를 삭제해야 합니다.
for_each_available_child_of_node()for_each_child_of_node()for_each_node_by_type()for_each_compatible_node()of_for_each_phandle()
- 앞서 언급한 변경사항은 Linux
6.12-rc4(aosp/3315251 참고)를 출시하는 동안 복원되어 CONFIG_OF_DYNAMIC를 다시 사용 설정하고 결함이 있는 드라이버를 노출할 수 있습니다.
이 페이지에 나와 있는 콘텐츠와 코드 샘플에는 콘텐츠 라이선스에서 설명하는 라이선스가 적용됩니다. 자바 및 OpenJDK는 Oracle 및 Oracle 계열사의 상표 또는 등록 상표입니다.
최종 업데이트: 2025-07-27(UTC)
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["필요한 정보가 없음","missingTheInformationINeed","thumb-down"],["너무 복잡함/단계 수가 너무 많음","tooComplicatedTooManySteps","thumb-down"],["오래됨","outOfDate","thumb-down"],["번역 문제","translationIssue","thumb-down"],["샘플/코드 문제","samplesCodeIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-27(UTC)"],[],[],null,["# GKI 16-6.12 android-mainline errata\n\nThis page describes important issues and bug fixes found on `android-mainline`\nthat might be significant to partners.\n\nNovember 15, 2024\n-----------------\n\n- **Clang is updated to 19.0.1 for `android-mainline` and `android16-6.12`**\n\n - Summary: The new version of Clang introduces a bounds sanitizer for arrays, where the array's size is stored in a separate variable linked to the array using the `__counted_by` attribute. This feature might cause a kernel panic if the array size isn't properly updated. The error message looks like this:\n\n UBSAN: array-index-out-of-bounds in common/net/wireless/nl80211.c\n index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')\n\n - Details: The bounds sanitizer is essential to protect the integrity of the\n kernel by detecting out-of-bounds access. And with `CONFIG_UBSAN_TRAP`\n enabled, bounds sanitizer triggers a kernel panic on any finding.\n\n - Previous version of the bounds sanitizer checked only fixed-size arrays and couldn't check dynamically allocated arrays. The new version uses the `__counted_by` attribute to determine the array bounds at runtime and detect more cases of out-of-bound access. However, in some cases, the array is accessed before the size variable is set, triggering the bounds sanitizer and causing a kernel panic. To address this issue, set the array's size immediately after allocating the underlying memory, as illustrated in [aosp/3343204](https://android-review.googlesource.com/c/kernel/common/+/3343204).\n - About `CONFIG_UBSAN_SIGNED_WRAP`: The new version of Clang sanitizes signed\n integer overflow and underflow despite the `-fwrapv` compiler flag. The\n `-fwrapv` flag is designed to treat signed integers as two's complement\n unsigned integers with defined overflow behavior.\n\n - While sanitizing signed integer overflow in the Linux kernel can help identify bugs, there are instances where overflow is intentional, for example, with `atomic_long_t`. As a result, `CONFIG_UBSAN_SIGNED_WRAP` [has been disabled](https://android-review.googlesource.com/c/kernel/common/+/3343205) to allow UBSAN to function solely as a bounds sanitizer.\n - About `CONFIG_UBSAN_TRAP`: UBSAN is configured to trigger a kernel panic\n when it detects an issue to protect the integrity of the kernel.\n However, we disabled this behavior from\n [October 23](https://android-review.googlesource.com/c/kernel/common/+/3315125)\n to\n [November 12](https://android-review.googlesource.com/c/kernel/common/+/3318796).\n We did this to unblock the compiler update while we fixed known `__counted_by`\n issues.\n\nNovember 1, 2024\n----------------\n\n- **Linux 6.12-rc4 landing**\n - Summary: `CONFIG_OF_DYNAMIC` potentially causing severe regressions for faulty drivers.\n - The details: While merging Linux `6.12-rc1` into `android-mainline` we noticed issues with out-of-tree drivers failing to load. The change that exposed the driver bugs was identified as commit `274aff8711b2 (\"clk: Add\n KUnit tests for clks registered with struct clk_parent_data\")` and we temporarily reverted it in [aosp/3287735](https://android-review.googlesource.com/c/kernel/common/+/3287735). The change selects `CONFIG_OF_OVERLAY`, which selects `CONFIG_OF_DYNAMIC`. With `!OF_DYNAMIC`, ref-counting on `of_node_get()` and `of_node_put()` is effectively disabled as they are implemented as `noops`. Enabling `OF_DYNAMIC` again exposes issues in drivers wrongly implementing ref-counting for `struct device_node`. This causes various types of errors like memory corruption, use-after-free, and memory leaks.\n - All uses of OF parsing related APIs must be inspected. The following list is partial, but contains cases we have been observing:\n - Use after free (UAF):\n - Reuse of the same `device_node` argument: Those functions call `of_node_put()` on the node given, potentially need to add an `of_node_get()` before calling them (for example, when calling repeatedly with the same node as argument):\n - `of_find_compatible_node()`\n - `of_find_node_by_name()`\n - `of_find_node_by_path()`\n - `of_find_node_by_type()`\n - `of_get_next_cpu_node()`\n - `of_get_next_parent()`\n - `of_get_next_child()`\n - `of_get_next_available_child()`\n - `of_get_next_reserved_child()`\n - `of_find_node_with_property()`\n - `of_find_matching_node_and_match()`\n - Use of `device_node` after any type of exit from certain loops:\n - `for_each_available_child_of_node_scoped()`\n - `for_each_available_child_of_node()`\n - `for_each_child_of_node_scoped()`\n - `for_each_child_of_node()`\n - Keeping direct pointers to `char *` properties from `device_node` around, for example, using:\n - `const char *foo = struct device_node::name`\n - `of_property_read_string()`\n - `of_property_read_string_array()`\n - `of_property_read_string_index()`\n - `of_get_property()`\n - Memory leaks:\n - Getting a `device_node` and forgetting to unref it (`of_node_put()`). Nodes returned from these need to be freed at some point:\n - `of_find_compatible_node()`\n - `of_find_node_by_name()`\n - `of_find_node_by_path()`\n - `of_find_node_by_type()`\n - `of_find_node_by_phandle()`\n - `of_parse_phandle()`\n - `of_find_node_opts_by_path()`\n - `of_get_next_cpu_node()`\n - `of_get_compatible_child()`\n - `of_get_child_by_name()`\n - `of_get_parent()`\n - `of_get_next_parent()`\n - `of_get_next_child()`\n - `of_get_next_available_child()`\n - `of_get_next_reserved_child()`\n - `of_find_node_with_property()`\n - `of_find_matching_node_and_match()`\n - Keeping a `device_node` from a loop iteration. If you're returning or breaking from within the following, you need to drop the remaining reference at some point:\n - `for_each_available_child_of_node()`\n - `for_each_child_of_node()`\n - `for_each_node_by_type()`\n - `for_each_compatible_node()`\n - `of_for_each_phandle()`\n - The earlier mentioned change was restored while landing Linux `6.12-rc4` (see [aosp/3315251](https://android-review.googlesource.com/c/kernel/common/+/3315251)) enabling `CONFIG_OF_DYNAMIC` again and potentially exposing faulty drivers."]]
