From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756797AbdKOFm2 (ORCPT ); Wed, 15 Nov 2017 00:42:28 -0500 Received: from shards.monkeyblade.net ([184.105.139.130]:53338 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756702AbdKOFmS (ORCPT ); Wed, 15 Nov 2017 00:42:18 -0500 Date: Wed, 15 Nov 2017 14:42:15 +0900 (KST) Message-Id: <20171115.144215.1875016289797792026.davem@davemloft.net> To: elena.reshetova@intel.com Cc: linux-kernel@vger.kernel.org, sparclinux@vger.kernel.org, shannon.nelson@oracle.com, jag.raman@oracle.com, peterz@infradead.org, keescook@chromium.org Subject: Re: [PATCH] sparc64: convert mdesc_handle.refcnt from atomic_t to refcount_t From: David Miller In-Reply-To: <1508486277-24913-1-git-send-email-elena.reshetova@intel.com> References: <1508486277-24913-1-git-send-email-elena.reshetova@intel.com> X-Mailer: Mew version 6.7 on Emacs 25.3 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Tue, 14 Nov 2017 21:42:18 -0800 (PST) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Elena Reshetova Date: Fri, 20 Oct 2017 10:57:57 +0300 > atomic_t variables are currently used to implement reference > counters with the following properties: > - counter is initialized to 1 using atomic_set() > - a resource is freed upon counter reaching zero > - once counter reaches zero, its further > increments aren't allowed > - counter schema uses basic atomic operations > (set, inc, inc_not_zero, dec_and_test, etc.) > > Such atomic variables should be converted to a newly provided > refcount_t type and API that prevents accidental counter overflows > and underflows. This is important since overflows and underflows > can lead to use-after-free situation and be exploitable. > > The variable mdesc_handle.refcnt is used as pure reference counter. > Convert it to refcount_t and fix up the operations. > > Suggested-by: Kees Cook > Reviewed-by: David Windsor > Reviewed-by: Hans Liljestrand > Signed-off-by: Elena Reshetova Applied.