From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Harald Freudenberger <freude@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
Sasha Levin <sashal@kernel.org>,
linux-s390@vger.kernel.org
Subject: [PATCH AUTOSEL 5.5 10/58] s390/zcrypt: fix card and queue total counter wrap
Date: Sat, 22 Feb 2020 21:20:31 -0500 [thread overview]
Message-ID: <20200223022119.707-10-sashal@kernel.org> (raw)
In-Reply-To: <20200223022119.707-1-sashal@kernel.org>
From: Harald Freudenberger <freude@linux.ibm.com>
[ Upstream commit fcd98d4002539f1e381916fc1b6648938c1eac76 ]
The internal statistic counters for the total number of
requests processed per card and per queue used integers. So they do
wrap after a rather huge amount of crypto requests processed. This
patch introduces uint64 counters which should hold much longer but
still may wrap. The sysfs attributes request_count for card and queue
also used only %ld and now display the counter value with %llu.
This is not a security relevant fix. The int overflow which happened
is not in any way exploitable as a security breach.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/crypto/ap_bus.h | 4 ++--
drivers/s390/crypto/ap_card.c | 8 ++++----
drivers/s390/crypto/ap_queue.c | 6 +++---
drivers/s390/crypto/zcrypt_api.c | 16 +++++++++-------
4 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index bb35ba4a8d243..4348fdff1c61e 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -162,7 +162,7 @@ struct ap_card {
unsigned int functions; /* AP device function bitfield. */
int queue_depth; /* AP queue depth.*/
int id; /* AP card number. */
- atomic_t total_request_count; /* # requests ever for this AP device.*/
+ atomic64_t total_request_count; /* # requests ever for this AP device.*/
};
#define to_ap_card(x) container_of((x), struct ap_card, ap_dev.device)
@@ -179,7 +179,7 @@ struct ap_queue {
enum ap_state state; /* State of the AP device. */
int pendingq_count; /* # requests on pendingq list. */
int requestq_count; /* # requests on requestq list. */
- int total_request_count; /* # requests ever for this AP device.*/
+ u64 total_request_count; /* # requests ever for this AP device.*/
int request_timeout; /* Request timeout in jiffies. */
struct timer_list timeout; /* Timer for request timeouts. */
struct list_head pendingq; /* List of message sent to AP queue. */
diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
index 63b4cc6cd7e59..e85bfca1ed163 100644
--- a/drivers/s390/crypto/ap_card.c
+++ b/drivers/s390/crypto/ap_card.c
@@ -63,13 +63,13 @@ static ssize_t request_count_show(struct device *dev,
char *buf)
{
struct ap_card *ac = to_ap_card(dev);
- unsigned int req_cnt;
+ u64 req_cnt;
req_cnt = 0;
spin_lock_bh(&ap_list_lock);
- req_cnt = atomic_read(&ac->total_request_count);
+ req_cnt = atomic64_read(&ac->total_request_count);
spin_unlock_bh(&ap_list_lock);
- return snprintf(buf, PAGE_SIZE, "%d\n", req_cnt);
+ return snprintf(buf, PAGE_SIZE, "%llu\n", req_cnt);
}
static ssize_t request_count_store(struct device *dev,
@@ -83,7 +83,7 @@ static ssize_t request_count_store(struct device *dev,
for_each_ap_queue(aq, ac)
aq->total_request_count = 0;
spin_unlock_bh(&ap_list_lock);
- atomic_set(&ac->total_request_count, 0);
+ atomic64_set(&ac->total_request_count, 0);
return count;
}
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 37c3bdc3642dc..a317ab4849320 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -479,12 +479,12 @@ static ssize_t request_count_show(struct device *dev,
char *buf)
{
struct ap_queue *aq = to_ap_queue(dev);
- unsigned int req_cnt;
+ u64 req_cnt;
spin_lock_bh(&aq->lock);
req_cnt = aq->total_request_count;
spin_unlock_bh(&aq->lock);
- return snprintf(buf, PAGE_SIZE, "%d\n", req_cnt);
+ return snprintf(buf, PAGE_SIZE, "%llu\n", req_cnt);
}
static ssize_t request_count_store(struct device *dev,
@@ -676,7 +676,7 @@ void ap_queue_message(struct ap_queue *aq, struct ap_message *ap_msg)
list_add_tail(&ap_msg->list, &aq->requestq);
aq->requestq_count++;
aq->total_request_count++;
- atomic_inc(&aq->card->total_request_count);
+ atomic64_inc(&aq->card->total_request_count);
/* Send/receive as many request from the queue as possible. */
ap_wait(ap_sm_event_loop(aq, AP_EVENT_POLL));
spin_unlock_bh(&aq->lock);
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 9157e728a362d..7fa0262e91af0 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -605,8 +605,8 @@ static inline bool zcrypt_card_compare(struct zcrypt_card *zc,
weight += atomic_read(&zc->load);
pref_weight += atomic_read(&pref_zc->load);
if (weight == pref_weight)
- return atomic_read(&zc->card->total_request_count) >
- atomic_read(&pref_zc->card->total_request_count);
+ return atomic64_read(&zc->card->total_request_count) >
+ atomic64_read(&pref_zc->card->total_request_count);
return weight > pref_weight;
}
@@ -1216,11 +1216,12 @@ static void zcrypt_qdepth_mask(char qdepth[], size_t max_adapters)
spin_unlock(&zcrypt_list_lock);
}
-static void zcrypt_perdev_reqcnt(int reqcnt[], size_t max_adapters)
+static void zcrypt_perdev_reqcnt(u32 reqcnt[], size_t max_adapters)
{
struct zcrypt_card *zc;
struct zcrypt_queue *zq;
int card;
+ u64 cnt;
memset(reqcnt, 0, sizeof(int) * max_adapters);
spin_lock(&zcrypt_list_lock);
@@ -1232,8 +1233,9 @@ static void zcrypt_perdev_reqcnt(int reqcnt[], size_t max_adapters)
|| card >= max_adapters)
continue;
spin_lock(&zq->queue->lock);
- reqcnt[card] = zq->queue->total_request_count;
+ cnt = zq->queue->total_request_count;
spin_unlock(&zq->queue->lock);
+ reqcnt[card] = (cnt < UINT_MAX) ? (u32) cnt : UINT_MAX;
}
}
local_bh_enable();
@@ -1411,9 +1413,9 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
return 0;
}
case ZCRYPT_PERDEV_REQCNT: {
- int *reqcnt;
+ u32 *reqcnt;
- reqcnt = kcalloc(AP_DEVICES, sizeof(int), GFP_KERNEL);
+ reqcnt = kcalloc(AP_DEVICES, sizeof(u32), GFP_KERNEL);
if (!reqcnt)
return -ENOMEM;
zcrypt_perdev_reqcnt(reqcnt, AP_DEVICES);
@@ -1470,7 +1472,7 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
}
case Z90STAT_PERDEV_REQCNT: {
/* the old ioctl supports only 64 adapters */
- int reqcnt[MAX_ZDEV_CARDIDS];
+ u32 reqcnt[MAX_ZDEV_CARDIDS];
zcrypt_perdev_reqcnt(reqcnt, MAX_ZDEV_CARDIDS);
if (copy_to_user((int __user *) arg, reqcnt, sizeof(reqcnt)))
--
2.20.1
next prev parent reply other threads:[~2020-02-23 2:37 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-23 2:20 [PATCH AUTOSEL 5.5 01/58] ipmi:ssif: Handle a possible NULL pointer reference Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 02/58] drm/msm: Set dma maximum segment size for mdss Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 03/58] sched/core: Don't skip remote tick for idle CPUs Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 04/58] timers/nohz: Update NOHZ load in remote tick Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 05/58] sched/fair: Prevent unlimited runtime on throttled group Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 06/58] dax: pass NOWAIT flag to iomap_apply Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 07/58] mac80211: consider more elements in parsing CRC Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 08/58] cfg80211: check wiphy driver existence for drvinfo report Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 09/58] io_uring: flush overflowed CQ events in the io_uring_poll() Sasha Levin
2020-02-23 2:20 ` Sasha Levin [this message]
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 11/58] qmi_wwan: re-add DW5821e pre-production variant Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 12/58] qmi_wwan: unconditionally reject 2 ep interfaces Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 13/58] NFSv4: Fix races between open and dentry revalidation Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 14/58] perf/smmuv3: Use platform_get_irq_optional() for wired interrupt Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 15/58] arm/ftrace: Fix BE text poking Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 16/58] sched/psi: Fix OOB write when writing 0 bytes to PSI files Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 17/58] perf/x86/intel: Add Elkhart Lake support Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 18/58] perf/x86/cstate: Add Tremont support Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 19/58] perf/x86/msr: " Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 20/58] ceph: do not execute direct write in parallel if O_APPEND is specified Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 21/58] ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 22/58] drm/amd/display: Do not set optimized_require to false after plane disable Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 23/58] RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready() Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 24/58] drm/amd/display: Check engine is not NULL before acquiring Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 25/58] drm/amd/display: Limit minimum DPPCLK to 100MHz Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 26/58] drm/amd/display: Add initialitions for PLL2 clock source Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 27/58] amdgpu: Prevent build errors regarding soft/hard-float FP ABI tags Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 28/58] soc/tegra: fuse: Fix build with Tegra194 configuration Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 29/58] i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 30/58] net: ena: fix potential crash when rxfh key is NULL Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 31/58] net: ena: fix uses of round_jiffies() Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 32/58] net: ena: add missing ethtool TX timestamping indication Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 33/58] net: ena: fix incorrect default RSS key Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 34/58] net: ena: rss: do not allocate key when not supported Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 35/58] net: ena: rss: fix failure to get indirection table Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 36/58] net: ena: rss: store hash function as values and not bits Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 37/58] net: ena: fix incorrectly saving queue numbers when setting RSS indirection table Sasha Levin
2020-02-23 2:20 ` [PATCH AUTOSEL 5.5 38/58] net: ena: fix corruption of dev_idx_to_host_tbl Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 39/58] net: ena: ethtool: use correct value for crc32 hash Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 40/58] net: ena: ena-com.c: prevent NULL pointer dereference Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 41/58] enic: prevent waking up stopped tx queues over watchdog reset Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 42/58] ice: Fix switch between FW and SW LLDP Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 43/58] ice: Don't allow same value for Rx tail to be written twice Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 44/58] ice: fix and consolidate logging of NVM/firmware version information Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 45/58] ice: update Unit Load Status bitmask to check after reset Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 46/58] ice: Use ice_pf_to_dev Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 47/58] ice: Use correct netif error function Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 48/58] io-wq: don't call kXalloc_node() with non-online node Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 49/58] cifs: Fix mode output in debugging statements Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 50/58] bcache: ignore pending signals when creating gc and allocator thread Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 51/58] cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 52/58] mac80211: fix wrong 160/80+80 MHz setting Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 53/58] net: hns3: add management table after IMP reset Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 54/58] net: hns3: fix VF bandwidth does not take effect in some case Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 55/58] net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples() Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 56/58] nvme/tcp: fix bug on double requeue when send fails Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 57/58] nvme: prevent warning triggered by nvme_stop_keep_alive Sasha Levin
2020-02-23 2:21 ` [PATCH AUTOSEL 5.5 58/58] nvme/pci: move cqe check after device shutdown Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200223022119.707-10-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=freude@linux.ibm.com \
--cc=gor@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox