- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] fpga: manager: add owner module and take its refcount
by Liu Chuang 09 Jul '24

09 Jul '24

From: Marco Pagani <marpagan(a)redhat.com> mainline inclusion from mainline-v6.10-rc1 commit 4d4d2d4346857bf778fafaa97d6f76bb1663e3c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7YM1 CVE: CVE-2024-37021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation of the fpga manager assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the manager if the parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_manager struct and use it to take the module's refcount. Modify the functions for registering the manager to take an additional owner module parameter and rename them to avoid conflicts. Use the old function names for helper macros that automatically set the module that registers the manager as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a manager without setting the owner. Also, update the documentation to keep it consistent with the new interface for registering an fpga manager. Other changes: opportunistically move put_device() from __fpga_mgr_get() to fpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the manager device is taken in these functions. Fixes: 654ba4cc0f3e ("fpga manager: ensure lifetime with of_fpga_mgr_get") Suggested-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Suggested-by: Xu Yilun <yilun.xu(a)intel.com> Signed-off-by: Marco Pagani <marpagan(a)redhat.com> Acked-by: Xu Yilun <yilun.xu(a)intel.com> Link: https://lore.kernel.org/r/20240305192926.84886-1-marpagan@redhat.com Signed-off-by: Xu Yilun <yilun.xu(a)linux.intel.com> Conflicts: drivers/fpga/fpga-mgr.c include/linux/fpga/fpga-mgr.h Documentation/driver-api/fpga/fpga-mgr.rst [Liu Chuang: add owner module.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/fpga/fpga-mgr.c | 62 ++++++++++++++++++++--------------- include/linux/fpga/fpga-mgr.h | 14 +++++--- 2 files changed, 46 insertions(+), 30 deletions(-) diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c index f38bab01432e..f65ea09af2fb 100644 --- a/drivers/fpga/fpga-mgr.c +++ b/drivers/fpga/fpga-mgr.c @@ -444,20 +444,15 @@ static struct attribute *fpga_mgr_attrs[] = { }; ATTRIBUTE_GROUPS(fpga_mgr); -static struct fpga_manager *__fpga_mgr_get(struct device *dev) +static struct fpga_manager *__fpga_mgr_get(struct device *mgr_dev) { struct fpga_manager *mgr; - mgr = to_fpga_manager(dev); - - if (!try_module_get(dev->parent->driver->owner)) - goto err_dev; + mgr = to_fpga_manager(mgr_dev); + if (!try_module_get(mgr->mops_owner)) + mgr = ERR_PTR(-ENODEV); return mgr; - -err_dev: - put_device(dev); - return ERR_PTR(-ENODEV); } static int fpga_mgr_dev_match(struct device *dev, const void *data) @@ -473,12 +468,18 @@ static int fpga_mgr_dev_match(struct device *dev, const void *data) */ struct fpga_manager *fpga_mgr_get(struct device *dev) { - struct device *mgr_dev = class_find_device(fpga_mgr_class, NULL, dev, - fpga_mgr_dev_match); + struct fpga_manager *mgr; + struct device *mgr_dev; + + mgr_dev = class_find_device(fpga_mgr_class, NULL, dev, fpga_mgr_dev_match); if (!mgr_dev) return ERR_PTR(-ENODEV); - return __fpga_mgr_get(mgr_dev); + mgr = __fpga_mgr_get(mgr_dev); + if (IS_ERR(mgr)) + put_device(mgr_dev); + + return mgr; } EXPORT_SYMBOL_GPL(fpga_mgr_get); @@ -491,13 +492,18 @@ EXPORT_SYMBOL_GPL(fpga_mgr_get); */ struct fpga_manager *of_fpga_mgr_get(struct device_node *node) { - struct device *dev; + struct fpga_manager *mgr; + struct device *mgr_dev; - dev = class_find_device_by_of_node(fpga_mgr_class, node); - if (!dev) + mgr_dev = class_find_device_by_of_node(fpga_mgr_class, node); + if (!mgr_dev) return ERR_PTR(-ENODEV); - return __fpga_mgr_get(dev); + mgr = __fpga_mgr_get(mgr_dev); + if (IS_ERR(mgr)) + put_device(mgr_dev); + + return mgr; } EXPORT_SYMBOL_GPL(of_fpga_mgr_get); @@ -507,7 +513,7 @@ EXPORT_SYMBOL_GPL(of_fpga_mgr_get); */ void fpga_mgr_put(struct fpga_manager *mgr) { - module_put(mgr->dev.parent->driver->owner); + module_put(mgr->mops_owner); put_device(&mgr->dev); } EXPORT_SYMBOL_GPL(fpga_mgr_put); @@ -546,20 +552,21 @@ void fpga_mgr_unlock(struct fpga_manager *mgr) EXPORT_SYMBOL_GPL(fpga_mgr_unlock); /** - * fpga_mgr_create - create and initialize a FPGA manager struct + * __fpga_mgr_create - create and initialize a FPGA manager struct * @dev: fpga manager device from pdev * @name: fpga manager name * @mops: pointer to structure of fpga manager ops * @priv: fpga manager private data + * @owner: owner module containing the ops * * The caller of this function is responsible for freeing the struct with * fpga_mgr_free(). Using devm_fpga_mgr_create() instead is recommended. * * Return: pointer to struct fpga_manager or NULL */ -struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, +struct fpga_manager *__fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv) + void *priv, struct module *owner) { struct fpga_manager *mgr; int id, ret; @@ -586,6 +593,8 @@ struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, mutex_init(&mgr->ref_mutex); + mgr->mops_owner = owner; + mgr->name = name; mgr->mops = mops; mgr->priv = priv; @@ -610,7 +619,7 @@ struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, return NULL; } -EXPORT_SYMBOL_GPL(fpga_mgr_create); +EXPORT_SYMBOL_GPL(__fpga_mgr_create); /** * fpga_mgr_free - free a FPGA manager created with fpga_mgr_create() @@ -631,11 +640,12 @@ static void devm_fpga_mgr_release(struct device *dev, void *res) } /** - * devm_fpga_mgr_create - create and initialize a managed FPGA manager struct + * __devm_fpga_mgr_create - create and initialize a managed FPGA manager struct * @dev: fpga manager device from pdev * @name: fpga manager name * @mops: pointer to structure of fpga manager ops * @priv: fpga manager private data + * @owner: owner module containing the ops * * This function is intended for use in a FPGA manager driver's probe function. * After the manager driver creates the manager struct with @@ -647,9 +657,9 @@ static void devm_fpga_mgr_release(struct device *dev, void *res) * * Return: pointer to struct fpga_manager or NULL */ -struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, +struct fpga_manager *__devm_fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv) + void *priv, struct module *owner) { struct fpga_manager **ptr, *mgr; @@ -657,7 +667,7 @@ struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, if (!ptr) return NULL; - mgr = fpga_mgr_create(dev, name, mops, priv); + mgr = __fpga_mgr_create(dev, name, mops, priv, owner); if (!mgr) { devres_free(ptr); } else { @@ -667,7 +677,7 @@ struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, return mgr; } -EXPORT_SYMBOL_GPL(devm_fpga_mgr_create); +EXPORT_SYMBOL_GPL(__devm_fpga_mgr_create); /** * fpga_mgr_register - register a FPGA manager diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h index e8ca62b2cb5b..7c97e1c359b0 100644 --- a/include/linux/fpga/fpga-mgr.h +++ b/include/linux/fpga/fpga-mgr.h @@ -162,6 +162,7 @@ struct fpga_compat_id { * @state: state of fpga manager * @compat_id: FPGA manager id for compatibility check. * @mops: pointer to struct of fpga manager ops + * @mops_owner: module containing the mops * @priv: low level driver private date */ struct fpga_manager { @@ -171,6 +172,7 @@ struct fpga_manager { enum fpga_mgr_states state; struct fpga_compat_id *compat_id; const struct fpga_manager_ops *mops; + struct module *mops_owner; void *priv; }; @@ -191,15 +193,19 @@ struct fpga_manager *fpga_mgr_get(struct device *dev); void fpga_mgr_put(struct fpga_manager *mgr); -struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, +#define fpga_mgr_create(dev, name, mops, priv) \ + __fpga_mgr_create(dev, name, mops, priv, THIS_MODULE) +struct fpga_manager *__fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv); + void *priv, struct module *owner); void fpga_mgr_free(struct fpga_manager *mgr); int fpga_mgr_register(struct fpga_manager *mgr); void fpga_mgr_unregister(struct fpga_manager *mgr); -struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, +#define devm_fpga_mgr_create(dev, name, mops, priv) \ + __devm_fpga_mgr_create(dev, name, mops, priv, THIS_MODULE) +struct fpga_manager *__devm_fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv); + void *priv, struct module *owner); #endif /*_LINUX_FPGA_MGR_H */ -- 2.34.1

2 1

[PATCH] Support selecting congestion control algorithms.
by Chengchang Tang 09 Jul '24

09 Jul '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Support configuring congestion control algorithms with hns direct verbs. New option: --congest_type Usage example: ./ib_send_bw -d hns_0 --congest_type=DCQCN ./ib_send_bw -d hns_0 --congest_type=DCQCN 192.168.100.100 update perftest.spec. Signed-off-by:Xinghai Cen <cenxinghai(a)partners.com> --- ...-selecting-congestion-control-algori.patch | 276 ++++++++++++++++++ perftest.spec | 9 +- 2 files changed, 284 insertions(+), 1 deletion(-) create mode 100644 0010-Perftest-Support-selecting-congestion-control-algori.patch diff --git a/0010-Perftest-Support-selecting-congestion-control-algori.patch b/0010-Perftest-Support-selecting-congestion-control-algori.patch new file mode 100644 index 0000000..ba539b2 --- /dev/null +++ b/0010-Perftest-Support-selecting-congestion-control-algori.patch @@ -0,0 +1,276 @@ +From d3d89123a650aa400be38d6ac939202a909783d4 Mon Sep 17 00:00:00 2001 +From: Guofeng Yue <yueguofeng(a)h-partners.com> +Date: Fri, 28 Jun 2024 10:56:09 +0800 +Subject: [PATCH] Perftest: Support selecting congestion control algorithms + +Support configuring congestion control algorithms with hns direct verbs. + + New option: --congest_type + + Usage example: + ./ib_send_bw -d hns_0 --congest_type=DCQCN + ./ib_send_bw -d hns_0 --congest_type=DCQCN 192.168.100.100 + +Signed-off-by: Guofeng Yue <yueguofeng(a)h-partners.com> +Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> +--- + Makefile.am | 24 ++++++++--------- + configure.ac | 7 +++++ + src/perftest_parameters.c | 57 +++++++++++++++++++++++++++++++++++++++ + src/perftest_parameters.h | 1 + + src/perftest_resources.c | 12 +++++++++ + src/perftest_resources.h | 3 +++ + 6 files changed, 92 insertions(+), 12 deletions(-) + +diff --git a/Makefile.am b/Makefile.am +index dc3ca41..807e169 100755 +--- a/Makefile.am ++++ b/Makefile.am +@@ -104,41 +104,41 @@ LIBMLX4= + endif + + ib_send_bw_SOURCES = src/send_bw.c src/multicast_resources.c src/multicast_resources.h +-ib_send_bw_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_send_bw_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_send_lat_SOURCES = src/send_lat.c src/multicast_resources.c src/multicast_resources.h +-ib_send_lat_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_send_lat_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_write_lat_SOURCES = src/write_lat.c +-ib_write_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_write_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_write_bw_SOURCES = src/write_bw.c +-ib_write_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_write_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_read_lat_SOURCES = src/read_lat.c +-ib_read_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_read_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_read_bw_SOURCES = src/read_bw.c +-ib_read_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_read_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_atomic_lat_SOURCES = src/atomic_lat.c +-ib_atomic_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_atomic_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_atomic_bw_SOURCES = src/atomic_bw.c +-ib_atomic_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_atomic_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + if HAVE_RAW_ETH + raw_ethernet_bw_SOURCES = src/raw_ethernet_send_bw.c +-raw_ethernet_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + raw_ethernet_lat_SOURCES = src/raw_ethernet_send_lat.c +-raw_ethernet_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + raw_ethernet_burst_lat_SOURCES = src/raw_ethernet_send_burst_lat.c +-raw_ethernet_burst_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_burst_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + raw_ethernet_fs_rate_SOURCES = src/raw_ethernet_fs_rate.c +-raw_ethernet_fs_rate_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_fs_rate_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + else + raw_ethernet_bw_SOURCES = +diff --git a/configure.ac b/configure.ac +index 71b8382..e59bf39 100755 +--- a/configure.ac ++++ b/configure.ac +@@ -382,6 +382,13 @@ if [test $HAVE_MLX5DV_LIB = yes] && [test $HAVE_MLX5DV = yes]; then + AC_SUBST([LIBMLX5]) + fi + ++AC_CHECK_LIB([hns], [hnsdv_query_device], [HAVE_HNSDV=yes LIBHNS=-lhns], [HAVE_HNSDV=no]) ++AM_CONDITIONAL([HAVE_HNSDV], [test "x$HAVE_HNSDV" = "xyes"]) ++if [test $HAVE_HNSDV = yes]; then ++ AC_DEFINE([HAVE_HNSDV], [1], [Have hns Direct Verbs support]) ++ AC_SUBST([LIBHNS]) ++fi ++ + CFLAGS="-g -Wall -D_GNU_SOURCE -O3 $CFLAGS" + LDFLAGS="$LDFLAGS" + LIBS=$LIBS" -lpthread" +diff --git a/src/perftest_parameters.c b/src/perftest_parameters.c +index dfa7241..cff1336 100755 +--- a/src/perftest_parameters.c ++++ b/src/perftest_parameters.c +@@ -34,6 +34,9 @@ static const char *portStates[] = {"Nop","Down","Init","Armed","","Active Defer" + static const char *qp_state[] = {"OFF","ON"}; + static const char *exchange_state[] = {"Ethernet","rdma_cm"}; + static const char *atomicTypesStr[] = {"CMP_AND_SWAP","FETCH_AND_ADD"}; ++#ifdef HAVE_HNSDV ++static const char *congestStr[] = {"DCQCN","LDCP","HC3","DIP"}; ++#endif + + /****************************************************************************** + * parse_mac_from_str. +@@ -438,6 +441,11 @@ static void usage(const char *argv0, VerbType verb, TestType tst, int connection + printf(" --cpu_util "); + printf(" Show CPU Utilization in report, valid only in Duration mode \n"); + ++ #ifdef HAVE_HNSDV ++ printf(" --congest_type=<DCQCN, LDCP, HC3, DIP> "); ++ printf(" Use the hnsdv interface to set congestion control algorithm.\n"); ++ #endif ++ + if (tst != FS_RATE) { + printf(" --dlid "); + printf(" Set a Destination LID instead of getting it from the other side.\n"); +@@ -863,6 +871,7 @@ static void init_perftest_params(struct perftest_parameters *user_param) + user_param->source_ip = NULL; + user_param->has_source_ip = 0; + user_param->use_write_with_imm = 0; ++ user_param->congest_type = OFF; + } + + static int open_file_write(const char* file_path) +@@ -961,6 +970,25 @@ static void change_conn_type(int *cptr, VerbType verb, const char *optarg) + exit(1); + } + } ++ ++#ifdef HAVE_HNSDV ++static void set_congest_type(int *cgtr, const char *optarg) ++{ ++ if (strcmp(congestStr[0], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_DCQCN; ++ } else if (strcmp(congestStr[1], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_LDCP; ++ } else if (strcmp(congestStr[2], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_HC3; ++ } else if (strcmp(congestStr[3], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_DIP; ++ } else { ++ fprintf(stderr, " Invalid congest type. Please choose from {DCQCN,LDCP,HC3,DIP}\n"); ++ exit(1); ++ } ++} ++#endif ++ + /****************************************************************************** + * + ******************************************************************************/ +@@ -1756,6 +1784,23 @@ static void force_dependecies(struct perftest_parameters *user_param) + } + } + ++ #ifdef HAVE_HNSDV ++ if (user_param->congest_type) { ++ if (user_param->work_rdma_cm == ON) ++ { ++ printf(RESULT_LINE); ++ fprintf(stderr, "rdma_cm does not support setting congest type.\n"); ++ exit(1); ++ } ++ ++ if (user_param->connection_type == XRC || user_param->connection_type == UD) { ++ printf(RESULT_LINE); ++ fprintf(stdout, "XRC/UD does not support setting congest type.\n"); ++ exit(1); ++ } ++ } ++ #endif ++ + return; + } + /****************************************************************************** +@@ -2273,6 +2318,9 @@ int parser(struct perftest_parameters *user_param,char *argv[], int argc) + static int credentials_path_flag = 0; + static int data_enc_key_app_path_flag = 0; + #endif ++ #ifdef HAVE_HNSDV ++ static int congest_type_flag = 0; ++ #endif + + char *server_ip = NULL; + char *client_ip = NULL; +@@ -2426,6 +2474,9 @@ int parser(struct perftest_parameters *user_param,char *argv[], int argc) + #if defined HAVE_OOO_ATTR + {.name = "use_ooo", .has_arg = 0, .flag = &use_ooo_flag, .val = 1}, + #endif ++ #ifdef HAVE_HNSDV ++ { .name = "congest_type", .has_arg = 1, .flag = &congest_type_flag, .val = 1}, ++ #endif + {.name = "bind_source_ip", .has_arg = 1, .flag = &source_ip_flag, .val = 1}, + {.name = "write_with_imm", .has_arg = 0, .flag = &use_write_with_imm_flag, .val = 1 }, + {0} +@@ -2720,6 +2771,12 @@ int parser(struct perftest_parameters *user_param,char *argv[], int argc) + free(duplicates_checker); + return FAILURE; + case 0: /* required for long options to work. */ ++ #ifdef HAVE_HNSDV ++ if (congest_type_flag) { ++ set_congest_type(&user_param->congest_type, optarg); ++ congest_type_flag = 0; ++ } ++ #endif + if (pkey_flag) { + CHECK_VALUE(user_param->pkey_index,int,"Pkey index",not_int_ptr); + pkey_flag = 0; +diff --git a/src/perftest_parameters.h b/src/perftest_parameters.h +index aa476f1..d26253d 100755 +--- a/src/perftest_parameters.h ++++ b/src/perftest_parameters.h +@@ -523,6 +523,7 @@ struct perftest_parameters { + int recv_post_list; + int duration; + int use_srq; ++ int congest_type; + int use_xrc; + int use_rss; + int srq_exists; +diff --git a/src/perftest_resources.c b/src/perftest_resources.c +index eeb679c..be3890c 100755 +--- a/src/perftest_resources.c ++++ b/src/perftest_resources.c +@@ -2219,6 +2219,9 @@ struct ibv_qp* ctx_qp_create(struct pingpong_context *ctx, + struct efadv_qp_init_attr efa_attr = {}; + #endif + #endif ++ #ifdef HAVE_HNSDV ++ struct hnsdv_qp_init_attr hns_attr = {}; ++ #endif + + attr.send_cq = ctx->send_cq; + attr.recv_cq = (user_param->verb == SEND || user_param->verb == WRITE_IMM) ? ctx->recv_cq : ctx->send_cq; +@@ -2382,6 +2385,15 @@ struct ibv_qp* ctx_qp_create(struct pingpong_context *ctx, + #endif // HAVE_AES_XTS + else + #endif // HAVE_MLX5DV ++ ++ #ifdef HAVE_HNSDV ++ if (user_param->congest_type) { ++ hns_attr.comp_mask = HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE; ++ hns_attr.congest_type = user_param->congest_type; ++ qp = hnsdv_create_qp(ctx->context, &attr_ex, &hns_attr); ++ } ++ else ++ #endif //HAVE_HNSDV + qp = ibv_create_qp_ex(ctx->context, &attr_ex); + } + else +diff --git a/src/perftest_resources.h b/src/perftest_resources.h +index 12386e2..565deda 100755 +--- a/src/perftest_resources.h ++++ b/src/perftest_resources.h +@@ -55,6 +55,9 @@ + #if defined(HAVE_MLX5DV) + #include <infiniband/mlx5dv.h> + #endif ++#if defined(HAVE_HNSDV) ++#include <infiniband/hnsdv.h> ++#endif + #include <rdma/rdma_cma.h> + #include <stdint.h> + #if defined(__FreeBSD__) +-- +2.33.0 + diff --git a/perftest.spec b/perftest.spec index c49d33d..c34a50b 100644 --- a/perftest.spec +++ b/perftest.spec @@ -1,6 +1,6 @@ Name: perftest Version: 4.5 -Release: 6 +Release: 7 License: GPLv2 or BSD Summary: RDMA Performance Testing Tools Url: https://github.com/linux-rdma/perftest @@ -15,6 +15,7 @@ Patch6: 0006-Perftest-Add-new-HNS-roce-device-ROH-to-support-new_.patch Patch7: 0007-add-loongarch-support-for-perftest.patch Patch8: 0008-Get-CPU-MHz-on-RISC-V.patch Patch9: 0009-Get-CPU-cycles-on-RISC-V.patch +Patch10: 0010-Perftest-Support-selecting-congestion-control-algori.patch BuildRequires: automake gcc libibverbs-devel >= 1.2.0 librdmacm-devel >= 1.0.21 libibumad-devel >= 1.3.10.2 BuildRequires: pciutils-devel libibverbs librdmacm libibumad @@ -41,6 +42,12 @@ done %_bindir/* %changelog +* Mon Jul 8 2024 Xinghai Cen <cenxinghai(a)h-partners.com> - 4.5-7 +- Type: feature +- ID: NA +- SUG: NA +- DESC: support selecting congestion control algorithms + * Fri Jan 19 2024 Chengchang Tang <tangchengchang(a)huawei.com> - 4.5-6 - Type: bugfix - ID: NA -- 2.33.0

1 0

[PATCH OLK-6.6] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.34 commit 7590da4c04dd4aa9c262da0231e978263861c6eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 upstream. Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index ee3b1a4e0848..8fa6796787f4 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1344,7 +1344,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static void __exit davinci_mmcsd_remove(struct platform_device *pdev) +static void davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1399,7 +1399,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove_new = __exit_p(davinci_mmcsd_remove), + .remove_new = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 647928ab00a3..77258948440f 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1347,7 +1347,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1404,7 +1404,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP1] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 647928ab00a3..77258948440f 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1347,7 +1347,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1404,7 +1404,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH OLK-5.10] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 647928ab00a3..77258948440f 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1347,7 +1347,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1404,7 +1404,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index e6f14257a7d0..591cef502b59 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1361,7 +1361,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1413,7 +1413,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH OLK-6.6 0/5] fix CVE-2024-38620
by Jialin Zhang 09 Jul '24

09 Jul '24

Christophe JAILLET (1): Bluetooth: Remove usage of the deprecated ida_simple_xx() API Iulia Tanasescu (1): Bluetooth: ISO: Fix BIS cleanup Luiz Augusto von Dentz (1): Bluetooth: HCI: Remove HCI_AMP support Lukas Bulwahn (1): Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS Pauli Virtanen (1): Bluetooth: fix connection setup in l2cap_connect drivers/bluetooth/btmrvl_main.c | 9 - drivers/bluetooth/btrsi.c | 1 - drivers/bluetooth/btsdio.c | 8 - drivers/bluetooth/btusb.c | 5 - drivers/bluetooth/hci_bcm4377.c | 1 - drivers/bluetooth/hci_ldisc.c | 6 - drivers/bluetooth/hci_serdev.c | 5 - drivers/bluetooth/hci_uart.h | 1 - drivers/bluetooth/hci_vhci.c | 10 +- drivers/bluetooth/virtio_bt.c | 2 - include/net/bluetooth/hci.h | 114 ------------ include/net/bluetooth/hci_core.h | 46 +---- include/net/bluetooth/hci_sync.h | 2 + include/uapi/linux/virtio_bt.h | 1 - net/bluetooth/hci_conn.c | 10 +- net/bluetooth/hci_core.c | 135 ++------------ net/bluetooth/hci_event.c | 310 ------------------------------- net/bluetooth/hci_sock.c | 9 +- net/bluetooth/hci_sync.c | 138 ++------------ net/bluetooth/l2cap_core.c | 21 +-- net/bluetooth/mgmt.c | 84 +++------ 21 files changed, 73 insertions(+), 845 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-22.03-LTS-SP1] ksmbd: fix slab out of bounds write in smb_inherit_dacl()
by Wang Zhaolong 09 Jul '24

09 Jul '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.7-rc1 commit eebff19acaa35820cb09ce2ccb3d21bee2156ffb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LC CVE: CVE-2023-52755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-22271 Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c fs/ksmbd/smbacl.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ksmbd/smbacl.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index d76cee773b82..e173717330ff 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -1098,6 +1098,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, struct smb_acl *pdacl; struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL; int powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size; + int pntsd_alloc_size; if (parent_pntsd->osidoffset) { powner_sid = (struct smb_sid *)((char *)parent_pntsd + @@ -1110,9 +1111,10 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pgroup_sid_size = 1 + 1 + 6 + (pgroup_sid->num_subauth * 4); } - pntsd = kzalloc(sizeof(struct smb_ntsd) + powner_sid_size + - pgroup_sid_size + sizeof(struct smb_acl) + - nt_size, GFP_KERNEL); + pntsd_alloc_size = sizeof(struct smb_ntsd) + powner_sid_size + + pgroup_sid_size + sizeof(struct smb_acl) + nt_size; + + pntsd = kzalloc(pntsd_alloc_size, GFP_KERNEL); if (!pntsd) { rc = -ENOMEM; goto free_aces_base; @@ -1127,6 +1129,27 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pntsd->gsidoffset = parent_pntsd->gsidoffset; pntsd->dacloffset = parent_pntsd->dacloffset; + if ((u64)le32_to_cpu(pntsd->osidoffset) + powner_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->gsidoffset) + pgroup_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->dacloffset) + sizeof(struct smb_acl) + nt_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + if (pntsd->osidoffset) { struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd + le32_to_cpu(pntsd->osidoffset)); -- 2.34.3

2 1

[PATCH OLK-5.10] ksmbd: fix slab out of bounds write in smb_inherit_dacl()
by Wang Zhaolong 09 Jul '24

09 Jul '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.7-rc1 commit eebff19acaa35820cb09ce2ccb3d21bee2156ffb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LC CVE: CVE-2023-52755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-22271 Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c fs/ksmbd/smbacl.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ksmbd/smbacl.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index d76cee773b82..e173717330ff 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -1098,6 +1098,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, struct smb_acl *pdacl; struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL; int powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size; + int pntsd_alloc_size; if (parent_pntsd->osidoffset) { powner_sid = (struct smb_sid *)((char *)parent_pntsd + @@ -1110,9 +1111,10 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pgroup_sid_size = 1 + 1 + 6 + (pgroup_sid->num_subauth * 4); } - pntsd = kzalloc(sizeof(struct smb_ntsd) + powner_sid_size + - pgroup_sid_size + sizeof(struct smb_acl) + - nt_size, GFP_KERNEL); + pntsd_alloc_size = sizeof(struct smb_ntsd) + powner_sid_size + + pgroup_sid_size + sizeof(struct smb_acl) + nt_size; + + pntsd = kzalloc(pntsd_alloc_size, GFP_KERNEL); if (!pntsd) { rc = -ENOMEM; goto free_aces_base; @@ -1127,6 +1129,27 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pntsd->gsidoffset = parent_pntsd->gsidoffset; pntsd->dacloffset = parent_pntsd->dacloffset; + if ((u64)le32_to_cpu(pntsd->osidoffset) + powner_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->gsidoffset) + pgroup_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->dacloffset) + sizeof(struct smb_acl) + nt_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + if (pntsd->osidoffset) { struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd + le32_to_cpu(pntsd->osidoffset)); -- 2.34.3

2 1