mirror of https://github.com/tiann/KernelSU.git synced 2025-08-27 23:46:34 +00:00

Go to file

Tashfin Shakeer Rhythm 9014c663d1 kernel: selinux: rules: Fix illegal RCU lock usage in apply_kernelsu_rules() (#2646 )

When kernel is compiled with CONFIG_DEBUG_ATOMIC_SLEEP enabled, it
prints the following splat in dmesg during post boot:

[ 6.739169] init: Opening SELinux policy
[ 6.751520] init: Loading SELinux policy
[ 6.894684] SELinux: policy capability network_peer_controls=1 [
6.894688] SELinux: policy capability open_perms=1 [ 6.894690] SELinux:
policy capability extended_socket_class=1 [ 6.894691] SELinux: policy
capability always_check_network=0 [ 6.894693] SELinux: policy capability
cgroup_seclabel=0 [ 6.894695] SELinux: policy capability
nnp_nosuid_transition=1 [ 7.214323] selinux: SELinux: Loaded file
context from: [ 7.214332] selinux:
/system/etc/selinux/plat_file_contexts [ 7.214339] selinux:
/system_ext/etc/selinux/system_ext_file_contexts [ 7.214345] selinux:
/product/etc/selinux/product_file_contexts [ 7.214350] selinux:
/vendor/etc/selinux/vendor_file_contexts [ 7.214356] selinux:
/odm/etc/selinux/odm_file_contexts [ 7.216398] KernelSU:
/system/bin/init argc: 2
[ 7.216401] KernelSU: /system/bin/init first arg: second_stage [
7.216403] KernelSU: /system/bin/init second_stage executed [ 7.216506]
BUG: sleeping function called from invalid context at
security/selinux/ss/hashtab.c:47 [ 7.216512] in_atomic(): 0,
irqs_disabled(): 0, non_block: 0, pid: 1, name: init [ 7.216516]
preempt_count: 0, expected: 0
[ 7.216518] RCU nest depth: 1, expected: 0
[ 7.216524] CPU: 6 PID: 1 Comm: init Not tainted
5.4.289-Scarlet-v2.0-beta3 #1 [ 7.216526] Hardware name: redwood based
Qualcomm Technologies, Inc. SM7325 (DT) [ 7.216528] Call trace:
[ 7.216536] dump_backtrace+0x0/0x210
[ 7.216539] show_stack+0x14/0x20
[ 7.216544] dump_stack+0x9c/0xec
[ 7.216548] __might_resched+0x1f0/0x210
[ 7.216552] hashtab_insert+0x38/0x230
[ 7.216557] add_type+0xd4/0x2e0
[ 7.216559] ksu_type+0x24/0x60
[ 7.216562] apply_kernelsu_rules+0xa8/0x650
[ 7.216565] ksu_handle_execveat_ksud+0x2a8/0x460
[ 7.216568] ksu_handle_execveat+0x2c/0x60
[ 7.216571] __arm64_sys_execve+0xe8/0xf0
[ 7.216574] el0_svc_common+0xf4/0x1a0
[ 7.216577] do_el0_svc+0x2c/0x40
[ 7.216579] el0_sync_handler+0x18c/0x200
[ 7.216582] el0_sync+0x140/0x180

This is because apply_kernelsu_rules() uses rcu_read_lock() to protect
SELinux policy modifications. However, cond_resched() from
hashtab_insert() at security/selinux/ss/hashtab.c is internally called
and it sleeps which is illegal under an RCU read-side critical section.

While replacing it with a spinlock would suppress the warning, this is
fundamentally incorrect because sleeping is illegal while holding a
spinlock and spinlock would turn off preemption which isn't an ideal
solution since it intentionally turns off rescheduling, and can lead to
deadlocks.

Instead, replace the RCU lock with a mutex lock. Mutex lock allows
sleeping when necessary, which is appropriate here because
apply_kernelsu_rules() runs in process context, not in atomic or
interrupt context. As apply_kernelsu_rules() is invoked only once during
post boot (SYSTEM_RUNNING), the mutex lock does not introduce any major
runtime performance regression and provides correct synchronization.

Fixes: https://github.com/tiann/KernelSU/issues/2637

Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>

2025-07-10 18:32:09 +08:00

.github

Update FUNDING.yml

2025-06-14 14:44:15 +08:00

docs

website: enhanced english/portuguese translation (#2427 )

2025-02-13 11:54:30 +08:00

website: enhanced english/portuguese translation (#2427 )

2025-02-13 11:54:30 +08:00

kernel

kernel: selinux: rules: Fix illegal RCU lock usage in apply_kernelsu_rules() (#2646 )

2025-07-10 18:32:09 +08:00

manager

manger: fix lkm detection (#2654 )

2025-06-27 14:17:31 +08:00

scripts

Fix ksubot session file ext dup (#1672 )

2024-04-27 00:10:54 +08:00

userspace

Update zip-extensions and set needed features for zip (#2592 )

2025-05-17 19:25:38 +08:00

website

Revert "website: Fix ads"

2025-05-18 00:00:56 +08:00

.gitattributes

Upgrade Gradle and AGP (#1431 )

2024-03-08 10:31:41 +08:00

.gitignore

manager: refactor to use AGP 8.0.0 (#414 )

2023-04-21 16:19:49 +08:00

justfile

misc: Add just command

2024-02-29 20:35:03 +08:00

LICENSE

Initial commit

2022-12-09 22:03:55 +08:00

SECURITY.md

Create SECURITY.md

2023-10-09 22:53:21 +08:00

docs/README.md

KernelSU

A kernel-based root solution for Android devices.

Features

Kernel-based su and root access management.
Module system based on OverlayFS.
App Profile: Lock up the root power in a cage.

Compatibility state

KernelSU officially supports Android GKI 2.0 devices (kernel 5.10+). Older kernels (4.14+) are also supported, but the kernel will need to be built manually.

With this, WSA, ChromeOS, and container-based Android are all supported.

Currently, only the arm64-v8a and x86_64 architectures are supported.

Usage

Translation

To help translate KernelSU or improve existing translations, please use Weblate. PR of Manager's translation is no longer accepted, because it will conflict with Weblate.

Discussion

Telegram: @KernelSU

Security

For information on reporting security vulnerabilities in KernelSU, see SECURITY.md.

License

Files under the kernel directory are GPL-2.0-only.
All other parts except the kernel directory are GPL-3.0-or-later.

Credits

Kernel-Assisted Superuser: The KernelSU idea.
Magisk: The powerful root tool.
genuine: APK v2 signature validation.
Diamorphine: Some rootkit skills.

Languages

Kotlin 44%

Rust 20.8%

C 20%

Java 6.3%

TypeScript 2.7%

Other 6%