lkml.org 
[lkml]   [2017]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3/4] sparc: convert mdesc_handle.refcnt from atomic_t to refcount_t
    Date
    refcount_t type and corresponding API should be
    used instead of atomic_t when the variable is used as
    a reference counter. This allows to avoid accidental
    refcounter overflows that might lead to use-after-free
    situations.

    Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
    Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: David Windsor <dwindsor@gmail.com>
    ---
    arch/sparc/kernel/mdesc.c | 17 +++++++++--------
    1 file changed, 9 insertions(+), 8 deletions(-)

    diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
    index c0765bb..ac3fe0d 100644
    --- a/arch/sparc/kernel/mdesc.c
    +++ b/arch/sparc/kernel/mdesc.c
    @@ -12,6 +12,7 @@
    #include <linux/miscdevice.h>
    #include <linux/bootmem.h>
    #include <linux/export.h>
    +#include <linux/refcount.h>

    #include <asm/cpudata.h>
    #include <asm/hypervisor.h>
    @@ -70,7 +71,7 @@ struct mdesc_handle {
    struct list_head list;
    struct mdesc_mem_ops *mops;
    void *self_base;
    - atomic_t refcnt;
    + refcount_t refcnt;
    unsigned int handle_size;
    struct mdesc_hdr mdesc;
    };
    @@ -84,7 +85,7 @@ static void mdesc_handle_init(struct mdesc_handle *hp,
    memset(hp, 0, handle_size);
    INIT_LIST_HEAD(&hp->list);
    hp->self_base = base;
    - atomic_set(&hp->refcnt, 1);
    + refcount_set(&hp->refcnt, 1);
    hp->handle_size = handle_size;
    }

    @@ -114,7 +115,7 @@ static void __init mdesc_memblock_free(struct mdesc_handle *hp)
    unsigned int alloc_size;
    unsigned long start;

    - BUG_ON(atomic_read(&hp->refcnt) != 0);
    + BUG_ON(refcount_read(&hp->refcnt) != 0);
    BUG_ON(!list_empty(&hp->list));

    alloc_size = PAGE_ALIGN(hp->handle_size);
    @@ -154,7 +155,7 @@ static struct mdesc_handle *mdesc_kmalloc(unsigned int mdesc_size)

    static void mdesc_kfree(struct mdesc_handle *hp)
    {
    - BUG_ON(atomic_read(&hp->refcnt) != 0);
    + BUG_ON(refcount_read(&hp->refcnt) != 0);
    BUG_ON(!list_empty(&hp->list));

    kfree(hp->self_base);
    @@ -193,7 +194,7 @@ struct mdesc_handle *mdesc_grab(void)
    spin_lock_irqsave(&mdesc_lock, flags);
    hp = cur_mdesc;
    if (hp)
    - atomic_inc(&hp->refcnt);
    + refcount_inc(&hp->refcnt);
    spin_unlock_irqrestore(&mdesc_lock, flags);

    return hp;
    @@ -205,7 +206,7 @@ void mdesc_release(struct mdesc_handle *hp)
    unsigned long flags;

    spin_lock_irqsave(&mdesc_lock, flags);
    - if (atomic_dec_and_test(&hp->refcnt)) {
    + if (refcount_dec_and_test(&hp->refcnt)) {
    list_del_init(&hp->list);
    hp->mops->free(hp);
    }
    @@ -344,7 +345,7 @@ void mdesc_update(void)
    if (status != HV_EOK || real_len > len) {
    printk(KERN_ERR "MD: mdesc reread fails with %lu\n",
    status);
    - atomic_dec(&hp->refcnt);
    + refcount_dec(&hp->refcnt);
    mdesc_free(hp);
    goto out;
    }
    @@ -357,7 +358,7 @@ void mdesc_update(void)
    mdesc_notify_clients(orig_hp, hp);

    spin_lock_irqsave(&mdesc_lock, flags);
    - if (atomic_dec_and_test(&orig_hp->refcnt))
    + if (refcount_dec_and_test(&orig_hp->refcnt))
    mdesc_free(orig_hp);
    else
    list_add(&orig_hp->list, &mdesc_zombie_list);
    --
    2.7.4
    \
     
     \ /
      Last update: 2017-02-20 12:07    [W:5.250 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site