From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Harald Freudenberger <freude@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
Sasha Levin <sashal@kernel.org>,
linux-s390@vger.kernel.org
Subject: [PATCH AUTOSEL 5.5 10/58] s390/zcrypt: fix card and queue total counter wrap
Date: Sat, 22 Feb 2020 21:20:31 -0500 [thread overview]
Message-ID: <20200223022119.707-10-sashal@kernel.org> (raw)
In-Reply-To: <20200223022119.707-1-sashal@kernel.org>
From: Harald Freudenberger <freude@linux.ibm.com>
[ Upstream commit fcd98d4002539f1e381916fc1b6648938c1eac76 ]
The internal statistic counters for the total number of
requests processed per card and per queue used integers. So they do
wrap after a rather huge amount of crypto requests processed. This
patch introduces uint64 counters which should hold much longer but
still may wrap. The sysfs attributes request_count for card and queue
also used only %ld and now display the counter value with %llu.
This is not a security relevant fix. The int overflow which happened
is not in any way exploitable as a security breach.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/crypto/ap_bus.h | 4 ++--
drivers/s390/crypto/ap_card.c | 8 ++++----
drivers/s390/crypto/ap_queue.c | 6 +++---
drivers/s390/crypto/zcrypt_api.c | 16 +++++++++-------
4 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index bb35ba4a8d243..4348fdff1c61e 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -162,7 +162,7 @@ struct ap_card {
unsigned int functions; /* AP device function bitfield. */
int queue_depth; /* AP queue depth.*/
int id; /* AP card number. */
- atomic_t total_request_count; /* # requests ever for this AP device.*/
+ atomic64_t total_request_count; /* # requests ever for this AP device.*/
};
#define to_ap_card(x) container_of((x), struct ap_card, ap_dev.device)
@@ -179,7 +179,7 @@ struct ap_queue {
enum ap_state state; /* State of the AP device. */
int pendingq_count; /* # requests on pendingq list. */
int requestq_count; /* # requests on requestq list. */
- int total_request_count; /* # requests ever for this AP device.*/
+ u64 total_request_count; /* # requests ever for this AP device.*/
int request_timeout; /* Request timeout in jiffies. */
struct timer_list timeout; /* Timer for request timeouts. */
struct list_head pendingq; /* List of message sent to AP queue. */
diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
index 63b4cc6cd7e59..e85bfca1ed163 100644
--- a/drivers/s390/crypto/ap_card.c
+++ b/drivers/s390/crypto/ap_card.c
@@ -63,13 +63,13 @@ static ssize_t request_count_show(struct device *dev,
char *buf)
{
struct ap_card *ac = to_ap_card(dev);
- unsigned int req_cnt;
+ u64 req_cnt;
req_cnt = 0;
spin_lock_bh(&ap_list_lock);
- req_cnt = atomic_read(&ac->total_request_count);
+ req_cnt = atomic64_read(&ac->total_request_count);
spin_unlock_bh(&ap_list_lock);
- return snprintf(buf, PAGE_SIZE, "%d\n", req_cnt);
+ return snprintf(buf, PAGE_SIZE, "%llu\n", req_cnt);
}
static ssize_t request_count_store(struct device *dev,
@@ -83,7 +83,7 @@ static ssize_t request_count_store(struct device *dev,
for_each_ap_queue(aq, ac)
aq->total_request_count = 0;
spin_unlock_bh(&ap_list_lock);
- atomic_set(&ac->total_request_count, 0);
+ atomic64_set(&ac->total_request_count, 0);
return count;
}
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 37c3bdc3642dc..a317ab4849320 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -479,12 +479,12 @@ static ssize_t request_count_show(struct device *dev,
char *buf)
{
struct ap_queue *aq = to_ap_queue(dev);
- unsigned int req_cnt;
+ u64 req_cnt;
spin_lock_bh(&aq->lock);
req_cnt = aq->total_request_count;
spin_unlock_bh(&aq->lock);
- return snprintf(buf, PAGE_SIZE, "%d\n", req_cnt);
+ return snprintf(buf, PAGE_SIZE, "%llu\n", req_cnt);
}
static ssize_t request_count_store(struct device *dev,
@@ -676,7 +676,7 @@ void ap_queue_message(struct ap_queue *aq, struct ap_message *ap_msg)
list_add_tail(&ap_msg->list, &aq->requestq);
aq->requestq_count++;
aq->total_request_count++;
- atomic_inc(&aq->card->total_request_count);
+ atomic64_inc(&aq->card->total_request_count);
/* Send/receive as many request from the queue as possible. */
ap_wait(ap_sm_event_loop(aq, AP_EVENT_POLL));
spin_unlock_bh(&aq->lock);
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 9157e728a362d..7fa0262e91af0 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -605,8 +605,8 @@ static inline bool zcrypt_card_compare(struct zcrypt_card *zc,
weight += atomic_read(&zc->load);
pref_weight += atomic_read(&pref_zc->load);
if (weight == pref_weight)
- return atomic_read(&zc->card->total_request_count) >
- atomic_read(&pref_zc->card->total_request_count);
+ return atomic64_read(&zc->card->total_request_count) >
+ atomic64_read(&pref_zc->card->total_request_count);
return weight > pref_weight;
}
@@ -1216,11 +1216,12 @@ static void zcrypt_qdepth_mask(char qdepth[], size_t max_adapters)
spin_unlock(&zcrypt_list_lock);
}
-static void zcrypt_perdev_reqcnt(int reqcnt[], size_t max_adapters)
+static void zcrypt_perdev_reqcnt(u32 reqcnt[], size_t max_adapters)
{
struct zcrypt_card *zc;
struct zcrypt_queue *zq;
int card;
+ u64 cnt;
memset(reqcnt, 0, sizeof(int) * max_adapters);
spin_lock(&zcrypt_list_lock);
@@ -1232,8 +1233,9 @@ static void zcrypt_perdev_reqcnt(int reqcnt[], size_t max_adapters)
|| card >= max_adapters)
continue;
spin_lock(&zq->queue->lock);
- reqcnt[card] = zq->queue->total_request_count;
+ cnt = zq->queue->total_request_count;
spin_unlock(&zq->queue->lock);
+ reqcnt[card] = (cnt < UINT_MAX) ? (u32) cnt : UINT_MAX;
}
}
local_bh_enable();
@@ -1411,9 +1413,9 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
return 0;
}
case ZCRYPT_PERDEV_REQCNT: {
- int *reqcnt;
+ u32 *reqcnt;
- reqcnt = kcalloc(AP_DEVICES, sizeof(int), GFP_KERNEL);
+ reqcnt = kcalloc(AP_DEVICES, sizeof(u32), GFP_KERNEL);
if (!reqcnt)
return -ENOMEM;
zcrypt_perdev_reqcnt(reqcnt, AP_DEVICES);
@@ -1470,7 +1472,7 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
}
case Z90STAT_PERDEV_REQCNT: {
/* the old ioctl supports only 64 adapters */
- int reqcnt[MAX_ZDEV_CARDIDS];
+ u32 reqcnt[MAX_ZDEV_CARDIDS];
zcrypt_perdev_reqcnt(reqcnt, MAX_ZDEV_CARDIDS);
if (copy_to_user((int __user *) arg, reqcnt, sizeof(reqcnt)))
--
2.20.1
next prev parent reply other threads:[~2020-02-23 2:21 UTC|newest]
Thread overview: 83+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-23 2:20 [PATCH AUTOSEL 5.5 01/58] ipmi:ssif: Handle a possible NULL pointer reference Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 02/58] drm/msm: Set dma maximum segment size for mdss Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 03/58] sched/core: Don't skip remote tick for idle CPUs Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 04/58] timers/nohz: Update NOHZ load in remote tick Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 05/58] sched/fair: Prevent unlimited runtime on throttled group Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 06/58] dax: pass NOWAIT flag to iomap_apply Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 07/58] mac80211: consider more elements in parsing CRC Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 08/58] cfg80211: check wiphy driver existence for drvinfo report Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 09/58] io_uring: flush overflowed CQ events in the io_uring_poll() Sasha Levin
2020-02-23 2:20 ` Sasha Levin [this message]
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 11/58] qmi_wwan: re-add DW5821e pre-production variant Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 12/58] qmi_wwan: unconditionally reject 2 ep interfaces Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 13/58] NFSv4: Fix races between open and dentry revalidation Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 14/58] perf/smmuv3: Use platform_get_irq_optional() for wired interrupt Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 15/58] arm/ftrace: Fix BE text poking Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 16/58] sched/psi: Fix OOB write when writing 0 bytes to PSI files Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 17/58] perf/x86/intel: Add Elkhart Lake support Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 18/58] perf/x86/cstate: Add Tremont support Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 19/58] perf/x86/msr: " Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 20/58] ceph: do not execute direct write in parallel if O_APPEND is specified Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 21/58] ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 22/58] drm/amd/display: Do not set optimized_require to false after plane disable Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 23/58] RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready() Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 24/58] drm/amd/display: Check engine is not NULL before acquiring Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 25/58] drm/amd/display: Limit minimum DPPCLK to 100MHz Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 26/58] drm/amd/display: Add initialitions for PLL2 clock source Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 27/58] amdgpu: Prevent build errors regarding soft/hard-float FP ABI tags Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 28/58] soc/tegra: fuse: Fix build with Tegra194 configuration Sasha Levin
2020-02-23 2:20 ` [Intel-wired-lan] [PATCH AUTOSEL 5.5 29/58] i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps Sasha Levin
2020-02-23 2:20 ` Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 30/58] net: ena: fix potential crash when rxfh key is NULL Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 31/58] net: ena: fix uses of round_jiffies() Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 32/58] net: ena: add missing ethtool TX timestamping indication Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 33/58] net: ena: fix incorrect default RSS key Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 34/58] net: ena: rss: do not allocate key when not supported Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 35/58] net: ena: rss: fix failure to get indirection table Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 36/58] net: ena: rss: store hash function as values and not bits Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 37/58] net: ena: fix incorrectly saving queue numbers when setting RSS indirection table Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 38/58] net: ena: fix corruption of dev_idx_to_host_tbl Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 39/58] net: ena: ethtool: use correct value for crc32 hash Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 40/58] net: ena: ena-com.c: prevent NULL pointer dereference Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 41/58] enic: prevent waking up stopped tx queues over watchdog reset Sasha Levin
2020-02-23 2:21 ` [Intel-wired-lan] [PATCH AUTOSEL 5.5 42/58] ice: Fix switch between FW and SW LLDP Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [Intel-wired-lan] [PATCH AUTOSEL 5.5 43/58] ice: Don't allow same value for Rx tail to be written twice Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [Intel-wired-lan] [PATCH AUTOSEL 5.5 44/58] ice: fix and consolidate logging of NVM/firmware version information Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [Intel-wired-lan] [PATCH AUTOSEL 5.5 45/58] ice: update Unit Load Status bitmask to check after reset Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [Intel-wired-lan] [PATCH AUTOSEL 5.5 46/58] ice: Use ice_pf_to_dev Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [Intel-wired-lan] [PATCH AUTOSEL 5.5 47/58] ice: Use correct netif error function Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 48/58] io-wq: don't call kXalloc_node() with non-online node Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 49/58] cifs: Fix mode output in debugging statements Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 50/58] bcache: ignore pending signals when creating gc and allocator thread Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 51/58] cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 52/58] mac80211: fix wrong 160/80+80 MHz setting Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 53/58] net: hns3: add management table after IMP reset Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 54/58] net: hns3: fix VF bandwidth does not take effect in some case Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 55/58] net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples() Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 56/58] nvme/tcp: fix bug on double requeue when send fails Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 57/58] nvme: prevent warning triggered by nvme_stop_keep_alive Sasha Levin
2020-02-23 2:21 ` Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 58/58] nvme/pci: move cqe check after device shutdown Sasha Levin
2020-02-23 2:21 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200223022119.707-10-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=freude@linux.ibm.com \
--cc=gor@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.