Skip to content

[FIPS-8-Compliant] batch 12 fips-8-compliant/4.18.0-553.16.1 #581

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Sep 19, 2025
Merged

[FIPS-8-Compliant] batch 12 fips-8-compliant/4.18.0-553.16.1 #581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f9118e5
scsi: lpfc: Use memcpy() for BIOS version
PlaidCat Sep 18, 2025
f175187
idpf: convert control queue mutex to a spinlock
PlaidCat Sep 18, 2025
325a6c5
tipc: Fix use-after-free in tipc_conn_close().
PlaidCat Sep 18, 2025
c1bf840
net/sched: sch_qfq: Fix race condition on qfq_aggregate
PlaidCat Sep 18, 2025
9a068aa
net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in…
PlaidCat Sep 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 11 additions & 12 deletions drivers/net/ethernet/intel/idpf/idpf_controlq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,16 +96,15 @@ static void idpf_ctlq_init_rxq_bufs(struct idpf_ctlq_info *cq)
*/
static void idpf_ctlq_shutdown(struct idpf_hw *hw, struct idpf_ctlq_info *cq)
{
mutex_lock(&cq->cq_lock);
spin_lock(&cq->cq_lock);

/* free ring buffers and the ring itself */
idpf_ctlq_dealloc_ring_res(hw, cq);

/* Set ring_size to 0 to indicate uninitialized queue */
cq->ring_size = 0;

mutex_unlock(&cq->cq_lock);
mutex_destroy(&cq->cq_lock);
spin_unlock(&cq->cq_lock);
}

/**
Expand Down Expand Up @@ -173,7 +172,7 @@ int idpf_ctlq_add(struct idpf_hw *hw,

idpf_ctlq_init_regs(hw, cq, is_rxq);

mutex_init(&cq->cq_lock);
spin_lock_init(&cq->cq_lock);

list_add(&cq->cq_list, &hw->cq_list_head);

Expand Down Expand Up @@ -272,7 +271,7 @@ int idpf_ctlq_send(struct idpf_hw *hw, struct idpf_ctlq_info *cq,
int err = 0;
int i;

mutex_lock(&cq->cq_lock);
spin_lock(&cq->cq_lock);

/* Ensure there are enough descriptors to send all messages */
num_desc_avail = IDPF_CTLQ_DESC_UNUSED(cq);
Expand Down Expand Up @@ -332,7 +331,7 @@ int idpf_ctlq_send(struct idpf_hw *hw, struct idpf_ctlq_info *cq,
wr32(hw, cq->reg.tail, cq->next_to_use);

err_unlock:
mutex_unlock(&cq->cq_lock);
spin_unlock(&cq->cq_lock);

return err;
}
Expand Down Expand Up @@ -364,7 +363,7 @@ int idpf_ctlq_clean_sq(struct idpf_ctlq_info *cq, u16 *clean_count,
if (*clean_count > cq->ring_size)
return -EBADR;

mutex_lock(&cq->cq_lock);
spin_lock(&cq->cq_lock);

ntc = cq->next_to_clean;

Expand Down Expand Up @@ -394,7 +393,7 @@ int idpf_ctlq_clean_sq(struct idpf_ctlq_info *cq, u16 *clean_count,

cq->next_to_clean = ntc;

mutex_unlock(&cq->cq_lock);
spin_unlock(&cq->cq_lock);

/* Return number of descriptors actually cleaned */
*clean_count = i;
Expand Down Expand Up @@ -432,7 +431,7 @@ int idpf_ctlq_post_rx_buffs(struct idpf_hw *hw, struct idpf_ctlq_info *cq,
if (*buff_count > 0)
buffs_avail = true;

mutex_lock(&cq->cq_lock);
spin_lock(&cq->cq_lock);

if (tbp >= cq->ring_size)
tbp = 0;
Expand Down Expand Up @@ -521,7 +520,7 @@ int idpf_ctlq_post_rx_buffs(struct idpf_hw *hw, struct idpf_ctlq_info *cq,
wr32(hw, cq->reg.tail, cq->next_to_post);
}

mutex_unlock(&cq->cq_lock);
spin_unlock(&cq->cq_lock);

/* return the number of buffers that were not posted */
*buff_count = *buff_count - i;
Expand Down Expand Up @@ -549,7 +548,7 @@ int idpf_ctlq_recv(struct idpf_ctlq_info *cq, u16 *num_q_msg,
u16 i;

/* take the lock before we start messing with the ring */
mutex_lock(&cq->cq_lock);
spin_lock(&cq->cq_lock);

ntc = cq->next_to_clean;

Expand Down Expand Up @@ -608,7 +607,7 @@ int idpf_ctlq_recv(struct idpf_ctlq_info *cq, u16 *num_q_msg,

cq->next_to_clean = ntc;

mutex_unlock(&cq->cq_lock);
spin_unlock(&cq->cq_lock);

*num_q_msg = i;
if (*num_q_msg == 0)
Expand Down
2 changes: 1 addition & 1 deletion drivers/net/ethernet/intel/idpf/idpf_controlq_api.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ struct idpf_ctlq_info {

enum idpf_ctlq_type cq_type;
int q_id;
struct mutex cq_lock; /* control queue lock */
spinlock_t cq_lock; /* control queue lock */
/* used for interrupt processing */
u16 next_to_use;
u16 next_to_clean;
Expand Down
12 changes: 8 additions & 4 deletions drivers/net/ethernet/intel/idpf/idpf_lib.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2369,8 +2369,12 @@ void *idpf_alloc_dma_mem(struct idpf_hw *hw, struct idpf_dma_mem *mem, u64 size)
struct idpf_adapter *adapter = hw->back;
size_t sz = ALIGN(size, 4096);

mem->va = dma_alloc_coherent(&adapter->pdev->dev, sz,
&mem->pa, GFP_KERNEL);
/* The control queue resources are freed under a spinlock, contiguous
* pages will avoid IOMMU remapping and the use vmap (and vunmap in
* dma_free_*() path.
*/
mem->va = dma_alloc_attrs(&adapter->pdev->dev, sz, &mem->pa,
GFP_KERNEL, DMA_ATTR_FORCE_CONTIGUOUS);
mem->size = sz;

return mem->va;
Expand All @@ -2385,8 +2389,8 @@ void idpf_free_dma_mem(struct idpf_hw *hw, struct idpf_dma_mem *mem)
{
struct idpf_adapter *adapter = hw->back;

dma_free_coherent(&adapter->pdev->dev, mem->size,
mem->va, mem->pa);
dma_free_attrs(&adapter->pdev->dev, mem->size,
mem->va, mem->pa, DMA_ATTR_FORCE_CONTIGUOUS);
mem->size = 0;
mem->va = NULL;
mem->pa = 0;
Expand Down
4 changes: 2 additions & 2 deletions drivers/scsi/lpfc/lpfc_sli.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5970,9 +5970,9 @@ lpfc_sli4_get_ctl_attr(struct lpfc_hba *phba)
phba->sli4_hba.flash_id = bf_get(lpfc_cntl_attr_flash_id, cntl_attr);
phba->sli4_hba.asic_rev = bf_get(lpfc_cntl_attr_asic_rev, cntl_attr);

memset(phba->BIOSVersion, 0, sizeof(phba->BIOSVersion));
strlcat(phba->BIOSVersion, (char *)cntl_attr->bios_ver_str,
memcpy(phba->BIOSVersion, cntl_attr->bios_ver_str,
sizeof(phba->BIOSVersion));
phba->BIOSVersion[sizeof(phba->BIOSVersion) - 1] = '\0';

lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
"3086 lnk_type:%d, lnk_numb:%d, bios_ver:%s, "
Expand Down
33 changes: 22 additions & 11 deletions net/sched/sch_qfq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -412,7 +412,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
bool existing = false;
struct nlattr *tb[TCA_QFQ_MAX + 1];
struct qfq_aggregate *new_agg = NULL;
u32 weight, lmax, inv_w;
u32 weight, lmax, inv_w, old_weight, old_lmax;
int err;
int delta_w;

Expand Down Expand Up @@ -446,12 +446,16 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
inv_w = ONE_FP / weight;
weight = ONE_FP / inv_w;

if (cl != NULL &&
lmax == cl->agg->lmax &&
weight == cl->agg->class_weight)
return 0; /* nothing to change */
if (cl != NULL) {
sch_tree_lock(sch);
old_weight = cl->agg->class_weight;
old_lmax = cl->agg->lmax;
sch_tree_unlock(sch);
if (lmax == old_lmax && weight == old_weight)
return 0; /* nothing to change */
}

delta_w = weight - (cl ? cl->agg->class_weight : 0);
delta_w = weight - (cl ? old_weight : 0);

if (q->wsum + delta_w > QFQ_MAX_WSUM) {
pr_notice("qfq: total weight out of range (%d + %u)\n",
Expand Down Expand Up @@ -533,9 +537,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,

static void qfq_destroy_class(struct Qdisc *sch, struct qfq_class *cl)
{
struct qfq_sched *q = qdisc_priv(sch);

qfq_rm_from_agg(q, cl);
gen_kill_estimator(&cl->rate_est);
qdisc_put(cl->qdisc);
kfree(cl);
Expand All @@ -554,6 +555,7 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg,

qdisc_purge_queue(cl->qdisc);
qdisc_class_hash_remove(&q->clhash, &cl->common);
qfq_rm_from_agg(q, cl);

sch_tree_unlock(sch);

Expand Down Expand Up @@ -624,6 +626,7 @@ static int qfq_dump_class(struct Qdisc *sch, unsigned long arg,
{
struct qfq_class *cl = (struct qfq_class *)arg;
struct nlattr *nest;
u32 class_weight, lmax;

tcm->tcm_parent = TC_H_ROOT;
tcm->tcm_handle = cl->common.classid;
Expand All @@ -632,8 +635,13 @@ static int qfq_dump_class(struct Qdisc *sch, unsigned long arg,
nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
if (nest == NULL)
goto nla_put_failure;
if (nla_put_u32(skb, TCA_QFQ_WEIGHT, cl->agg->class_weight) ||
nla_put_u32(skb, TCA_QFQ_LMAX, cl->agg->lmax))

sch_tree_lock(sch);
class_weight = cl->agg->class_weight;
lmax = cl->agg->lmax;
sch_tree_unlock(sch);
if (nla_put_u32(skb, TCA_QFQ_WEIGHT, class_weight) ||
nla_put_u32(skb, TCA_QFQ_LMAX, lmax))
goto nla_put_failure;
return nla_nest_end(skb, nest);

Expand All @@ -650,8 +658,10 @@ static int qfq_dump_class_stats(struct Qdisc *sch, unsigned long arg,

memset(&xstats, 0, sizeof(xstats));

sch_tree_lock(sch);
xstats.weight = cl->agg->class_weight;
xstats.lmax = cl->agg->lmax;
sch_tree_unlock(sch);

if (gnet_stats_copy_basic(d, NULL, &cl->bstats, true) < 0 ||
gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
Expand Down Expand Up @@ -1490,6 +1500,7 @@ static void qfq_destroy_qdisc(struct Qdisc *sch)
for (i = 0; i < q->clhash.hashsize; i++) {
hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
common.hnode) {
qfq_rm_from_agg(q, cl);
qfq_destroy_class(sch, cl);
}
}
Expand Down
2 changes: 2 additions & 0 deletions net/tipc/topsrv.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -700,8 +700,10 @@ static void tipc_topsrv_stop(struct net *net)
for (id = 0; srv->idr_in_use; id++) {
con = idr_find(&srv->conn_idr, id);
if (con) {
conn_get(con);
spin_unlock_bh(&srv->idr_lock);
tipc_conn_close(con);
conn_put(con);
spin_lock_bh(&srv->idr_lock);
}
}
Expand Down
Loading