From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752779AbdJTK2f convert rfc822-to-8bit (ORCPT ); Fri, 20 Oct 2017 06:28:35 -0400 Received: from mga04.intel.com ([192.55.52.120]:20806 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752092AbdJTK2d (ORCPT ); Fri, 20 Oct 2017 06:28:33 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.43,405,1503385200"; d="scan'208";a="162777123" From: "Reshetova, Elena" To: "jack@suse.cz" CC: "linux-kernel@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "amir73il@gmail.com" , "peterz@infradead.org" , "keescook@chromium.org" Subject: RE: [PATCH 1/2] fsnotify: convert fsnotify_group.refcnt from atomic_t to refcount_t Thread-Topic: [PATCH 1/2] fsnotify: convert fsnotify_group.refcnt from atomic_t to refcount_t Thread-Index: AQHTSYwzRVH8dYVcy0O6/6cjpWHOOqLsiQcA Date: Fri, 20 Oct 2017 10:28:29 +0000 Message-ID: <2236FBA76BA1254E88B949DDB74E612B802B37C5@IRSMSX102.ger.corp.intel.com> References: <1508494331-32211-1-git-send-email-elena.reshetova@intel.com> In-Reply-To: <1508494331-32211-1-git-send-email-elena.reshetova@intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-ctpclassification: CTP_IC x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMzY0ZjVlYmUtM2JiNi00Mzk4LWIzYWEtY2E0NjRlZTY1MmViIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjIuNS4xOCIsIlRydXN0ZWRMYWJlbEhhc2giOiJ6VXViQ1ZITFpcL3IxTnIycm5BN1YyaG5VMTd0OExWZmpRNTA5d2pkUVpFSWZIUythWU1PcXNJYkdJRHQrQmh2ViJ9 x-originating-ip: [163.33.239.182] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Please ignore this one, I am resending them both. I think Intel mailer decided that I am sending too much mails for today and started bouncing me :( Best Regards, Elena. > -----Original Message----- > From: Reshetova, Elena > Sent: Friday, October 20, 2017 1:12 PM > To: jack@suse.cz > Cc: linux-kernel@vger.kernel.org; linux-fsdevel@vger.kernel.org; > amir73il@gmail.com; peterz@infradead.org; keescook@chromium.org; Reshetova, > Elena > Subject: [PATCH 1/2] fsnotify: convert fsnotify_group.refcnt from atomic_t to > refcount_t > > atomic_t variables are currently used to implement reference > counters with the following properties: > - counter is initialized to 1 using atomic_set() > - a resource is freed upon counter reaching zero > - once counter reaches zero, its further > increments aren't allowed > - counter schema uses basic atomic operations > (set, inc, inc_not_zero, dec_and_test, etc.) > > Such atomic variables should be converted to a newly provided > refcount_t type and API that prevents accidental counter overflows > and underflows. This is important since overflows and underflows > can lead to use-after-free situation and be exploitable. > > The variable fsnotify_group.refcnt is used as pure reference counter. > Convert it to refcount_t and fix up the operations. > > Suggested-by: Kees Cook > Reviewed-by: David Windsor > Reviewed-by: Hans Liljestrand > Signed-off-by: Elena Reshetova > --- > fs/notify/group.c | 6 +++--- > include/linux/fsnotify_backend.h | 3 ++- > 2 files changed, 5 insertions(+), 4 deletions(-) > > diff --git a/fs/notify/group.c b/fs/notify/group.c > index 3235753..b7a4b6a 100644 > --- a/fs/notify/group.c > +++ b/fs/notify/group.c > @@ -107,7 +107,7 @@ void fsnotify_destroy_group(struct fsnotify_group *group) > */ > void fsnotify_get_group(struct fsnotify_group *group) > { > - atomic_inc(&group->refcnt); > + refcount_inc(&group->refcnt); > } > > /* > @@ -115,7 +115,7 @@ void fsnotify_get_group(struct fsnotify_group *group) > */ > void fsnotify_put_group(struct fsnotify_group *group) > { > - if (atomic_dec_and_test(&group->refcnt)) > + if (refcount_dec_and_test(&group->refcnt)) > fsnotify_final_destroy_group(group); > } > > @@ -131,7 +131,7 @@ struct fsnotify_group *fsnotify_alloc_group(const struct > fsnotify_ops *ops) > return ERR_PTR(-ENOMEM); > > /* set to 0 when there a no external references to this group */ > - atomic_set(&group->refcnt, 1); > + refcount_set(&group->refcnt, 1); > atomic_set(&group->num_marks, 0); > atomic_set(&group->user_waits, 0); > > diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h > index c6c6931..20a57ba 100644 > --- a/include/linux/fsnotify_backend.h > +++ b/include/linux/fsnotify_backend.h > @@ -17,6 +17,7 @@ > #include > #include > #include > +#include > > /* > * IN_* from inotfy.h lines up EXACTLY with FS_*, this is so we can easily > @@ -135,7 +136,7 @@ struct fsnotify_group { > * inotify_init() and the refcnt will hit 0 only when that fd has been > * closed. > */ > - atomic_t refcnt; /* things with interest in > this group */ > + refcount_t refcnt; /* things with interest in > this group */ > > const struct fsnotify_ops *ops; /* how this group > handles things */ > > -- > 2.7.4