lkml.org 
[lkml]   [2017]   [Jun]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3/5] block: convert blkcg_gq.refcnt from atomic_t to refcount_t
    Date
    refcount_t type and corresponding API should be
    used instead of atomic_t when the variable is used as
    a reference counter. This allows to avoid accidental
    refcounter overflows that might lead to use-after-free
    situations.

    Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
    Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: David Windsor <dwindsor@gmail.com>
    ---
    block/blk-cgroup.c | 2 +-
    include/linux/blk-cgroup.h | 9 ++++-----
    2 files changed, 5 insertions(+), 6 deletions(-)

    diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
    index 0480892..3762908 100644
    --- a/block/blk-cgroup.c
    +++ b/block/blk-cgroup.c
    @@ -107,7 +107,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q,
    blkg->q = q;
    INIT_LIST_HEAD(&blkg->q_node);
    blkg->blkcg = blkcg;
    - atomic_set(&blkg->refcnt, 1);
    + refcount_set(&blkg->refcnt, 1);

    /* root blkg uses @q->root_rl, init rl only for !root blkgs */
    if (blkcg != &blkcg_root) {
    diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
    index 01b62e7..e54f048 100644
    --- a/include/linux/blk-cgroup.h
    +++ b/include/linux/blk-cgroup.h
    @@ -19,6 +19,7 @@
    #include <linux/radix-tree.h>
    #include <linux/blkdev.h>
    #include <linux/atomic.h>
    +#include <linux/refcount.h>

    /* percpu_counter batch for blkg_[rw]stats, per-cpu drift doesn't matter */
    #define BLKG_STAT_CPU_BATCH (INT_MAX / 2)
    @@ -122,7 +123,7 @@ struct blkcg_gq {
    struct request_list rl;

    /* reference count */
    - atomic_t refcnt;
    + refcount_t refcnt;

    /* is this blkg online? protected by both blkcg and q locks */
    bool online;
    @@ -354,8 +355,7 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen)
    */
    static inline void blkg_get(struct blkcg_gq *blkg)
    {
    - WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    - atomic_inc(&blkg->refcnt);
    + refcount_inc(&blkg->refcnt);
    }

    void __blkg_release_rcu(struct rcu_head *rcu);
    @@ -366,8 +366,7 @@ void __blkg_release_rcu(struct rcu_head *rcu);
    */
    static inline void blkg_put(struct blkcg_gq *blkg)
    {
    - WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
    - if (atomic_dec_and_test(&blkg->refcnt))
    + if (refcount_dec_and_test(&blkg->refcnt))
    call_rcu(&blkg->rcu_head, __blkg_release_rcu);
    }

    --
    2.7.4
    \
     
     \ /
      Last update: 2017-06-27 13:42    [W:4.579 / U:0.528 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site