!282 fix-CVE-2024-48916

From: @wangzengliang1 
Reviewed-by: @liuqinfei 
Signed-off-by: @liuqinfei

0003-fix-CVE-2023-46159.patch

@@ -0,0 +1,51 @@
+From 64803e1ced57d64b758927c3977bb4a4d1769180 Mon Sep 17 00:00:00 2001
+From: Joshua Baergen <jbaergen@digitalocean.com>
+Date: Tue, 12 Sep 2023 14:05:01 -0400
+Subject: [PATCH] rgw: Add missing empty checks to the split string in
+ is_string_in_set().
+
+In certain cases, where a user misconfigures a CORS rule, the entirety
+of the string can be token characters (or, at least, the string before
+and after a given token is all token characters), but != "*". If the
+misconfigured string includes "*" we'll try to split the string and we
+assume that we can pop the list of string elements when "*" isn't
+first/last, but get_str_list() won't return anything for token-only
+substrings and thus 'ssplit' will have fewer elements than would be
+expected for a correct rule. In the case of an empty list, front() has
+undefined behaviour; in our experience, it often results in a huge
+allocation attempt because the code tries to copy the string into a
+local variable 'sl'.
+
+An example of this misconfiguration (and thus a reproduction case) is
+configuring an origin of " *".
+
+Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>
+---
+ src/rgw/rgw_cors.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/rgw/rgw_cors.cc b/src/rgw/rgw_cors.cc
+index e41abf8ccb..bb80e2b58d 100644
+--- a/src/rgw/rgw_cors.cc
++++ b/src/rgw/rgw_cors.cc
+@@ -121,6 +121,8 @@ static bool is_string_in_set(set<string>& s, string h) {
+       
+       get_str_list((*it), "* \t", ssplit);
+       if (off != 0) {
++        if (ssplit.empty())
++          continue;
+         string sl = ssplit.front();
+         flen = sl.length();
+         dout(10) << "Finding " << sl << ", in " << h << ", at offset 0" << dendl;
+@@ -129,6 +131,8 @@ static bool is_string_in_set(set<string>& s, string h) {
+         ssplit.pop_front();
+       }
+       if (off != ((*it).length() - 1)) {
++        if (ssplit.empty())
++          continue;
+         string sl = ssplit.front();
+         dout(10) << "Finding " << sl << ", in " << h 
+           << ", at offset not less than " << flen << dendl;
+-- 
+2.15.0
+

0004-fix-mds-metadata-lost-in-one-case.patch

@@ -0,0 +1,42 @@
+From 56cbf3f0716b556c815487d719abe86021125925 Mon Sep 17 00:00:00 2001
+From: shimin <shimin@kuaishou.com>
+Date: Wed, 10 Apr 2024 09:10:04 +0800
+Subject: [PATCH] mon:fix mds metadata lost in one case
+In most cases, peon's pending_metadata is inconsistent with mon's db.
+When a peon turns into leader, and at the same time a active mds stops,
+the new leader may flush wrong mds metadata into db. So we meed to
+update mds metadata from db at every fsmap change.
+
+This phenomenon can be reproduce like this:
+A Cluster with 3 mon and 3 mds (one active, other two standby), 6 osd.
+step 1. stop two standby mds;
+step 2. restart all mon; (make pending_medata consistent with db)
+step 3. start other two mds
+step 4. stop leader mon
+step 5. run "ceph mds metadata" command to check mds metadata
+step 6. stop active mds
+step 7. run "ceph mds metadata" command to check mds metadata again
+
+In step 7, we would find mds metadata lost.
+
+Fixes: https://tracker.ceph.com/issues/63166
+Signed-off-by: shimin <shimin@kuaishou.com>
+---
+ src/mon/MDSMonitor.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/mon/MDSMonitor.cc b/src/mon/MDSMonitor.cc
+index 4b27d828c..0ac5060f7 100644
+--- a/src/mon/MDSMonitor.cc
++++ b/src/mon/MDSMonitor.cc
+@@ -136,6 +136,7 @@ void MDSMonitor::update_from_paxos(bool *need_bootstrap)
+ 	   << ", my e " << get_fsmap().epoch << dendl;
+   ceph_assert(version > get_fsmap().epoch);
+ 
++  load_metadata(pending_metadata);
+   load_health();
+ 
+   // read and decode
+-- 
+2.27.0
+

0005-fix-CVE-2024-48916.patch

@@ -0,0 +1,33 @@
+From 22b362ab9c7f72463f35addff53b34e301604104 Mon Sep 17 00:00:00 2001
+From: wangzengliang1 <wangzengliang2@huawei.com>
+Date: Sat, 28 Dec 2024 11:24:36 +0800
+Subject: [PATCH] fix CVE-2024-48916
+copyed-by: https://github.com/ceph/ceph/pull/60624
+  while authenticating AssumeRoleWithWebIdentity using JWT obtained
+  from an external IDP.
+
+fixes: https://tracker.ceph.com/issues/68836
+Signed-off-by Pritha Srivastava <prsrivas@redhat.com>
+---
+ src/rgw/rgw_rest_sts.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/rgw/rgw_rest_sts.cc b/src/rgw/rgw_rest_sts.cc
+index 09f77f6..878edc6 100644
+--- a/src/rgw/rgw_rest_sts.cc
++++ b/src/rgw/rgw_rest_sts.cc
+@@ -444,7 +444,11 @@ WebTokenEngine::validate_signature(const DoutPrefixProvider* dpp, const jwt::dec
+                               .allow_algorithm(jwt::algorithm::ps512{cert});
+ 
+                 verifier.verify(decoded);
++              } else {
++                ldpp_dout(dpp, 0) << "Unsupported algorithm: " << algorithm << dendl;
++                throw -EINVAL;
+               }
++
+             } catch (std::runtime_error& e) {
+               ldpp_dout(dpp, 0) << "Signature validation failed: " << e.what() << dendl;
+               throw;
+-- 
+1.8.3.1
+

9001-add-supprot-for-loongarch64.patch

@@ -0,0 +1,273 @@
+From b914e57a20fe0e8e7f0592c3bc041dc8d511cbdd Mon Sep 17 00:00:00 2001
+From: zhangzikang <zhangzikang@kylinos.cn>
+Date: Wed, 22 May 2024 16:59:10 +0800
+Subject: [PATCH] add supprot for loongarch64
+
+---
+ CMakeLists.txt                                       |  2 +-
+ src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake      |  2 ++
+ .../cpp/src/arrow/vendored/double-conversion/utils.h |  2 +-
+ .../cpp/src/arrow/vendored/fast_float/float_common.h |  2 +-
+ src/boost/boost/predef/architecture.h                |  1 +
+ src/boost/boostcpp.jam                               |  5 +++--
+ .../libs/config/checks/architecture/Jamfile.jam      |  1 +
+ .../libs/config/checks/architecture/loongarch.cpp    | 12 ++++++++++++
+ src/common/Cycles.h                                  |  4 ++++
+ src/jaegertracing/opentelemetry-cpp/CMakeLists.txt   |  2 ++
+ .../third_party/benchmark/src/cycleclock.h           |  2 +-
+ .../tools/vcpkg/ports/halide/CONTROL                 |  6 +++++-
+ .../tools/vcpkg/ports/halide/portfile.cmake          |  1 +
+ .../tools/vcpkg/ports/llvm/portfile.cmake            |  1 +
+ .../tools/vcpkg/ports/llvm/vcpkg.json                |  4 ++++
+ .../range/range_tree/lib/portability/toku_time.h     |  4 ++++
+ 16 files changed, 44 insertions(+), 7 deletions(-)
+ create mode 100644 src/boost/libs/config/checks/architecture/loongarch.cpp
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 884135cd8..c955d55c7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -275,7 +275,7 @@ if(WITH_BLUESTORE_PMEM)
+ endif()
+ 
+ CMAKE_DEPENDENT_OPTION(WITH_SPDK "Enable SPDK" OFF
+-  "CMAKE_SYSTEM_PROCESSOR MATCHES i386|i686|amd64|x86_64|AMD64|aarch64" OFF)
++  "CMAKE_SYSTEM_PROCESSOR MATCHES i386|i686|amd64|x86_64|AMD64|aarch64|loongarch64" OFF)
+ if(WITH_SPDK)
+   if(NOT WITH_BLUESTORE)
+     message(SEND_ERROR "Please enable WITH_BLUESTORE for using SPDK")
+diff --git a/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake b/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake
+index c1a1ba043..5f2a6cf37 100644
+--- a/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake
++++ b/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake
+@@ -32,6 +32,8 @@ if(NOT DEFINED ARROW_CPU_FLAG)
+     set(ARROW_CPU_FLAG "ppc")
+   elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "s390x")
+     set(ARROW_CPU_FLAG "s390x")
++  elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "loongarch64")
++    set(ARROW_CPU_FLAG "loongarch")
+   else()
+     set(ARROW_CPU_FLAG "x86")
+   endif()
+diff --git a/src/arrow/cpp/src/arrow/vendored/double-conversion/utils.h b/src/arrow/cpp/src/arrow/vendored/double-conversion/utils.h
+index 4328344d7..b86276950 100644
+--- a/src/arrow/cpp/src/arrow/vendored/double-conversion/utils.h
++++ b/src/arrow/cpp/src/arrow/vendored/double-conversion/utils.h
+@@ -93,7 +93,7 @@ int main(int argc, char** argv) {
+ #if defined(_M_X64) || defined(__x86_64__) || \
+     defined(__ARMEL__) || defined(__avr32__) || defined(_M_ARM) || defined(_M_ARM64) || \
+     defined(__hppa__) || defined(__ia64__) || \
+-    defined(__mips__) || \
++    defined(__mips__) || defined(__loongarch__) || \
+     defined(__powerpc__) || defined(__ppc__) || defined(__ppc64__) || \
+     defined(_POWER) || defined(_ARCH_PPC) || defined(_ARCH_PPC64) || \
+     defined(__sparc__) || defined(__sparc) || defined(__s390__) || \
+diff --git a/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h b/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h
+index f7b7662b9..8d11067f8 100644
+--- a/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h
++++ b/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h
+@@ -6,7 +6,7 @@
+ #include <cassert>
+ 
+ #if (defined(__x86_64) || defined(__x86_64__) || defined(_M_X64)   \
+-       || defined(__amd64) || defined(__aarch64__) || defined(_M_ARM64) \
++       || defined(__amd64) || defined(__aarch64__) || defined(_M_ARM64) || defined(__loongarch__)\
+        || defined(__MINGW64__)                                          \
+        || defined(__s390x__)                                            \
+        || (defined(__ppc64__) || defined(__PPC64__) || defined(__ppc64le__) || defined(__PPC64LE__)) \
+diff --git a/src/boost/boost/predef/architecture.h b/src/boost/boost/predef/architecture.h
+index b131a8928..a6fd00c36 100644
+--- a/src/boost/boost/predef/architecture.h
++++ b/src/boost/boost/predef/architecture.h
+@@ -30,6 +30,7 @@ http://www.boost.org/LICENSE_1_0.txt)
+ #include <boost/predef/architecture/sys370.h>
+ #include <boost/predef/architecture/sys390.h>
+ #include <boost/predef/architecture/x86.h>
++#include <boost/predef/architecture/loongarch.h>
+ #include <boost/predef/architecture/z.h>
+ 
+ #endif
+diff --git a/src/boost/boostcpp.jam b/src/boost/boostcpp.jam
+index 082536e2a..28099d877 100644
+--- a/src/boost/boostcpp.jam
++++ b/src/boost/boostcpp.jam
+@@ -634,7 +634,7 @@ rule address-model ( )
+     return <conditional>@boostcpp.deduce-address-model ;
+ }
+ 
+-local deducable-architectures = arm mips1 power riscv s390x sparc x86 combined ;
++local deducable-architectures = arm mips1 power riscv s390x sparc x86 combined loongarch ;
+ feature.feature deduced-architecture : $(deducable-architectures) : propagated optional composite hidden ;
+ for a in $(deducable-architectures)
+ {
+@@ -645,7 +645,7 @@ rule deduce-architecture ( properties * )
+ {
+     local result ;
+     local filtered = [ toolset-properties $(properties) ] ;
+-    local names = arm mips1 power riscv s390x sparc x86 combined ;
++    local names = arm mips1 power riscv s390x sparc x86 loongarch combined ;
+     local idx = [ configure.find-builds "default architecture" : $(filtered)
+         : /boost/architecture//arm
+         : /boost/architecture//mips1
+@@ -654,6 +654,7 @@ rule deduce-architecture ( properties * )
+         : /boost/architecture//s390x
+         : /boost/architecture//sparc
+         : /boost/architecture//x86
++        : /boost/architecture//loongarch
+         : /boost/architecture//combined ] ;
+     result = $(names[$(idx)]) ;
+ 
+diff --git a/src/boost/libs/config/checks/architecture/Jamfile.jam b/src/boost/libs/config/checks/architecture/Jamfile.jam
+index 2ba54f9ad..faf57eb13 100644
+--- a/src/boost/libs/config/checks/architecture/Jamfile.jam
++++ b/src/boost/libs/config/checks/architecture/Jamfile.jam
+@@ -23,4 +23,5 @@ obj power    : power.cpp ;
+ obj riscv    : riscv.cpp ;
+ obj sparc    : sparc.cpp ;
+ obj x86      : x86.cpp ;
++obj loongarch      : loongarch.cpp ;
+ obj s390x    : s390x.cpp ;
+diff --git a/src/boost/libs/config/checks/architecture/loongarch.cpp b/src/boost/libs/config/checks/architecture/loongarch.cpp
+new file mode 100644
+index 000000000..ecd84e0a4
+--- /dev/null
++++ b/src/boost/libs/config/checks/architecture/loongarch.cpp
+@@ -0,0 +1,12 @@
++// loongarch.cpp
++//
++// Copyright (c) 2012 Steven Watanabe
++//
++// Distributed under the Boost Software License Version 1.0. (See
++// accompanying file LICENSE_1_0.txt or copy at
++// http://www.boost.org/LICENSE_1_0.txt)
++
++#if !defined(__loongarch) && !defined(__loongarch__) && !defined(__loongarch64__) \
++    && !defined(__loong) && !defined(__LOONGARCH__)
++#error "Not LOONGARCH"
++#endif
+diff --git a/src/common/Cycles.h b/src/common/Cycles.h
+index b546479c2..1bae9d616 100644
+--- a/src/common/Cycles.h
++++ b/src/common/Cycles.h
+@@ -84,6 +84,10 @@ class Cycles {
+     uint64_t tsc;
+     asm volatile("stck %0" : "=Q" (tsc) : : "cc");
+     return tsc;
++#elif defined(__loongarch__)
++  struct timeval tv;
++  gettimeofday(&tv, nullptr);
++  return static_cast<int64_t>(tv.tv_sec) * 1000000 + tv.tv_usec;
+ #else
+ #warning No high-precision counter available for your OS/arch
+     return 0;
+diff --git a/src/jaegertracing/opentelemetry-cpp/CMakeLists.txt b/src/jaegertracing/opentelemetry-cpp/CMakeLists.txt
+index 6d2b27435..46b54793e 100755
+--- a/src/jaegertracing/opentelemetry-cpp/CMakeLists.txt
++++ b/src/jaegertracing/opentelemetry-cpp/CMakeLists.txt
+@@ -64,6 +64,8 @@ else()
+     set(ARCH riscv)
+   elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(s390x.*|S390X.*)")
+     set(ARCH s390x)
++  elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(loongarch64.*|LOONGARCH64.*)")
++    set(ARCH loongarch)
+   else()
+     message(
+       FATAL_ERROR
+diff --git a/src/jaegertracing/opentelemetry-cpp/third_party/benchmark/src/cycleclock.h b/src/jaegertracing/opentelemetry-cpp/third_party/benchmark/src/cycleclock.h
+index 9bef594be..e7d523fea 100644
+--- a/src/jaegertracing/opentelemetry-cpp/third_party/benchmark/src/cycleclock.h
++++ b/src/jaegertracing/opentelemetry-cpp/third_party/benchmark/src/cycleclock.h
+@@ -204,7 +204,7 @@ inline BENCHMARK_ALWAYS_INLINE int64_t Now() {
+   asm volatile("rdcycle %0" : "=r"(cycles));
+   return cycles;
+ #endif
+-#elif defined(__e2k__) || defined(__elbrus__)
++#elif defined(__e2k__) || defined(__elbrus__) || defined(__loongarch__)
+   struct timeval tv;
+   gettimeofday(&tv, nullptr);
+   return static_cast<int64_t>(tv.tv_sec) * 1000000 + tv.tv_usec;
+diff --git a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/CONTROL b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/CONTROL
+index 8ffcc93dd..512bfdf8c 100644
+--- a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/CONTROL
++++ b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/CONTROL
+@@ -12,7 +12,7 @@ Build-Depends: halide[core,target-x86] (x86|x64), halide[core,target-arm] (arm&!
+ 
+ Feature: target-all
+ Description: Include all targets
+-Build-Depends: halide[core,target-aarch64,target-amdgpu,target-arm,target-d3d12compute,target-hexagon,target-metal,target-mips,target-nvptx,target-opencl,target-opengl,target-powerpc,target-riscv,target-x86]
++Build-Depends: halide[core,target-aarch64,target-amdgpu,target-arm,target-d3d12compute,target-hexagon,target-metal,target-mips,target-nvptx,target-opencl,target-opengl,target-powerpc,target-riscv,target-x86,target-loongarch]
+ 
+ Feature: target-aarch64
+ Description: Include AArch64 target
+@@ -62,3 +62,7 @@ Feature: target-x86
+ Description: Include X86 target
+ Build-Depends: llvm[core,target-x86]
+ 
++Feature: target-loongarch
++Description: Include LOONGARCH target
++Build-Depends: llvm[core,target-loongarch]
++
+diff --git a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/portfile.cmake b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/portfile.cmake
+index b8e08adda..51e106739 100644
+--- a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/portfile.cmake
++++ b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/halide/portfile.cmake
+@@ -27,6 +27,7 @@ vcpkg_check_features(OUT_FEATURE_OPTIONS FEATURE_OPTIONS
+     target-powerpc TARGET_POWERPC
+     target-riscv TARGET_RISCV
+     target-x86 TARGET_X86
++    target-loongarch TARGET_LOONGARCH
+ )
+ 
+ vcpkg_configure_cmake(
+diff --git a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/portfile.cmake b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/portfile.cmake
+index 356a25bf1..c793fceb4 100644
+--- a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/portfile.cmake
++++ b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/portfile.cmake
+@@ -181,6 +181,7 @@ set(known_llvm_targets
+     WebAssembly
+     X86
+     XCore
++    LOONGARCH
+ )
+ 
+ set(LLVM_TARGETS_TO_BUILD "")
+diff --git a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/vcpkg.json b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/vcpkg.json
+index 4590e5111..c34d78292 100644
+--- a/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/vcpkg.json
++++ b/src/jaegertracing/opentelemetry-cpp/tools/vcpkg/ports/llvm/vcpkg.json
+@@ -258,6 +258,7 @@
+             "target-systemz",
+             "target-webassembly",
+             "target-x86",
++            "target-loongarch",
+             "target-xcore"
+           ]
+         }
+@@ -308,6 +309,9 @@
+     "target-x86": {
+       "description": "Build with X86 backend."
+     },
++    "target-loongarch": {
++      "description": "Build with LOONGARCH backend."
++    },
+     "target-xcore": {
+       "description": "Build with XCore backend."
+     },
+diff --git a/src/rocksdb/utilities/transactions/lock/range/range_tree/lib/portability/toku_time.h b/src/rocksdb/utilities/transactions/lock/range/range_tree/lib/portability/toku_time.h
+index 46111e7f0..4555b8f71 100644
+--- a/src/rocksdb/utilities/transactions/lock/range/range_tree/lib/portability/toku_time.h
++++ b/src/rocksdb/utilities/transactions/lock/range/range_tree/lib/portability/toku_time.h
+@@ -154,6 +154,10 @@ static inline tokutime_t toku_time_now(void) {
+   uint64_t cycles;
+   asm volatile("rdcycle %0" : "=r"(cycles));
+   return cycles;
++#elif defined(__loongarch__)
++  struct timeval tv;
++  gettimeofday(&tv, nullptr);
++  return static_cast<int64_t>(tv.tv_sec) * 1000000 + tv.tv_usec;
+ #else
+ #error No timer implementation for this platform
+ #endif
+-- 
+2.33.0
+

9002-fix-riscv64-build.patch

@@ -0,0 +1,41 @@
+diff --git a/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake b/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake
+index c1a1ba0..84f224b 100644
+--- a/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake
++++ b/src/arrow/cpp/cmake_modules/SetupCxxFlags.cmake
+@@ -32,6 +32,8 @@ if(NOT DEFINED ARROW_CPU_FLAG)
+     set(ARROW_CPU_FLAG "ppc")
+   elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "s390x")
+     set(ARROW_CPU_FLAG "s390x")
++  elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "riscv64")
++    set(ARROW_CPU_FLAG "riscv64")
+   else()
+     set(ARROW_CPU_FLAG "x86")
+   endif()
+diff --git a/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h b/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h
+index f7b7662..c1fe08d 100644
+--- a/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h
++++ b/src/arrow/cpp/src/arrow/vendored/fast_float/float_common.h
+@@ -10,7 +10,7 @@
+        || defined(__MINGW64__)                                          \
+        || defined(__s390x__)                                            \
+        || (defined(__ppc64__) || defined(__PPC64__) || defined(__ppc64le__) || defined(__PPC64LE__)) \
+-       || defined(__EMSCRIPTEN__))
++       || defined(__EMSCRIPTEN__) || defined(__riscv))
+ #define FASTFLOAT_64BIT
+ #elif (defined(__i386) || defined(__i386__) || defined(_M_IX86)   \
+      || defined(__arm__)                                        \
+diff --git a/src/common/Cycles.h b/src/common/Cycles.h
+index b546479..14bc6bf 100644
+--- a/src/common/Cycles.h
++++ b/src/common/Cycles.h
+@@ -84,6 +84,10 @@ class Cycles {
+     uint64_t tsc;
+     asm volatile("stck %0" : "=Q" (tsc) : : "cc");
+     return tsc;
++#elif defined(__riscv) && __riscv_xlen == 64
++    uint64_t tsc;
++    asm volatile ("rdcycle %0" : "=r" (tsc));
++    return tsc;
+ #else
+ #warning No high-precision counter available for your OS/arch
+     return 0;

ceph.spec

@@ -174,7 +174,7 @@
 #################################################################################
 Name:		ceph
 Version:	18.2.2
-Release:	1
+Release:	6
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 Epoch:		2
 %endif
@@ -194,6 +194,17 @@ Source0:	%{?_remote_tarball_prefix}ceph-18.2.2.tar.gz
 #backport
 Patch1: 0001-modify-xsimd-source-to-local-and-set-cxx17-for-arrow.patch
 Patch2: 0002-fix-compilation-with-cython3.patch
+Patch3: 0003-fix-CVE-2023-46159.patch
+Patch4: 0004-fix-mds-metadata-lost-in-one-case.patch
+Patch5: 0005-fix-CVE-2024-48916.patch
+
+%ifarch loongarch64
+Patch5: 9001-add-supprot-for-loongarch64.patch
+%endif
+
+%ifarch riscv64
+Patch9002: 9002-fix-riscv64-build.patch
+%endif
 
 %if 0%{?suse_version}
 # _insert_obs_source_lines_here
@@ -273,7 +284,9 @@ BuildRequires:	snappy-devel
 BuildRequires:	sqlite-devel
 BuildRequires:	sudo
 BuildRequires:	pkgconfig(udev)
+%ifarch %{valgrind_arches}
 BuildRequires:	valgrind-devel
+%endif
 BuildRequires:	which
 BuildRequires:	xfsprogs-devel
 BuildRequires:	xmlstarlet
@@ -2631,6 +2644,22 @@ exit 0
 %{_datadir}/snmp/mibs
 
 %changelog
+* Fri Feb 21 2025 wangzengliang <wangzengliang2@huawei.com> - 2:18.2.2-6
+- fix-CVE-2024-48916
+
+* Sat May 25 2024 laokz <zhangkai@iscas.ac.cn> - 2:18.2.2-5
+- let BuildRequires:valgrind-devel depend on system arch macro
+- fix riscv64 build
+
+* Wed May 22 2024 zhangzikang <zhangzikang@kylinos.cn> - 2:18.2.2-4
+- Add supprot for loongarch64
+
+* Wed Apr 10 2024 cenhuilin <cenhuilin@kylinos.cn> - 2:18.2.2-3
+- mon: fix mds metadata lost in one case
+
+* Fri Mar 22 2024 lizhipeng <qiuxinyidian@gmail.com> - 2:18.2.2-2
+- fix CVE-2023-46159
+
 * Tue Mar 12 2024 wangzengliang <wangzengliang2@huawei.com> - 2:18.2.2-1
 - upgrade ceph to 18.2.2