From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751381AbdJWHLB (ORCPT ); Mon, 23 Oct 2017 03:11:01 -0400 Received: from mga06.intel.com ([134.134.136.31]:6215 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751254AbdJWHK7 (ORCPT ); Mon, 23 Oct 2017 03:10:59 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.43,421,1503385200"; d="scan'208";a="163672489" From: "Reshetova, Elena" To: Shannon Nelson , "davem@davemloft.net" CC: "linux-kernel@vger.kernel.org" , "sparclinux@vger.kernel.org" , "jag.raman@oracle.com" , "peterz@infradead.org" , "keescook@chromium.org" Subject: RE: [PATCH] sparc64: convert mdesc_handle.refcnt from atomic_t to refcount_t Thread-Topic: [PATCH] sparc64: convert mdesc_handle.refcnt from atomic_t to refcount_t Thread-Index: AQHTSXkvs8e8coBK3E+bGHvT9NV/I6Ls2vYAgAQuAsA= Date: Mon, 23 Oct 2017 07:10:55 +0000 Message-ID: <2236FBA76BA1254E88B949DDB74E612B802B4255@IRSMSX102.ger.corp.intel.com> References: <1508486277-24913-1-git-send-email-elena.reshetova@intel.com> <519f48f1-3145-6bf4-469f-0c6059681287@oracle.com> In-Reply-To: <519f48f1-3145-6bf4-469f-0c6059681287@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-ctpclassification: CTP_IC x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiODlhZDQyOTgtYzUzZS00MzMxLWE0MzktNDQxMjBkMWJlOTZjIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjIuNS4xOCIsIlRydXN0ZWRMYWJlbEhhc2giOiIxcDgyT0l0a205YWVqWHRjWUtaNHdCOWxwczN4TjR1SHRQWTQzRTJZZVd0YmR6OENkek9xeUpMZjFOYjZFclNcLyJ9 x-originating-ip: [163.33.239.180] Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id v9N7B5fq014504 > On 10/20/2017 12:57 AM, Elena Reshetova wrote: > > atomic_t variables are currently used to implement reference > > counters with the following properties: > > - counter is initialized to 1 using atomic_set() > > - a resource is freed upon counter reaching zero > > - once counter reaches zero, its further > > increments aren't allowed > > - counter schema uses basic atomic operations > > (set, inc, inc_not_zero, dec_and_test, etc.) > > > > Such atomic variables should be converted to a newly provided > > refcount_t type and API that prevents accidental counter overflows > > and underflows. This is important since overflows and underflows > > can lead to use-after-free situation and be exploitable. > > > > The variable mdesc_handle.refcnt is used as pure reference counter. > > Convert it to refcount_t and fix up the operations. > > > > Suggested-by: Kees Cook > > Reviewed-by: David Windsor > > Reviewed-by: Hans Liljestrand > > Signed-off-by: Elena Reshetova > > Acked-by: Shannon Nelson Thank you Shannon! Would you be able to take this patch into the respective tree to propagate normally from there? Best Regards, Elena. > > > --- > > arch/sparc/kernel/mdesc.c | 17 +++++++++-------- > > 1 file changed, 9 insertions(+), 8 deletions(-) > > > > diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c > > index fa466ce..821a724 100644 > > --- a/arch/sparc/kernel/mdesc.c > > +++ b/arch/sparc/kernel/mdesc.c > > @@ -12,6 +12,7 @@ > > #include > > #include > > #include > > +#include > > > > #include > > #include > > @@ -70,7 +71,7 @@ struct mdesc_handle { > > struct list_head list; > > struct mdesc_mem_ops *mops; > > void *self_base; > > - atomic_t refcnt; > > + refcount_t refcnt; > > unsigned int handle_size; > > struct mdesc_hdr mdesc; > > }; > > @@ -152,7 +153,7 @@ static void mdesc_handle_init(struct mdesc_handle *hp, > > memset(hp, 0, handle_size); > > INIT_LIST_HEAD(&hp->list); > > hp->self_base = base; > > - atomic_set(&hp->refcnt, 1); > > + refcount_set(&hp->refcnt, 1); > > hp->handle_size = handle_size; > > } > > > > @@ -182,7 +183,7 @@ static void __init mdesc_memblock_free(struct > mdesc_handle *hp) > > unsigned int alloc_size; > > unsigned long start; > > > > - BUG_ON(atomic_read(&hp->refcnt) != 0); > > + BUG_ON(refcount_read(&hp->refcnt) != 0); > > BUG_ON(!list_empty(&hp->list)); > > > > alloc_size = PAGE_ALIGN(hp->handle_size); > > @@ -220,7 +221,7 @@ static struct mdesc_handle *mdesc_kmalloc(unsigned int > mdesc_size) > > > > static void mdesc_kfree(struct mdesc_handle *hp) > > { > > - BUG_ON(atomic_read(&hp->refcnt) != 0); > > + BUG_ON(refcount_read(&hp->refcnt) != 0); > > BUG_ON(!list_empty(&hp->list)); > > > > kfree(hp->self_base); > > @@ -259,7 +260,7 @@ struct mdesc_handle *mdesc_grab(void) > > spin_lock_irqsave(&mdesc_lock, flags); > > hp = cur_mdesc; > > if (hp) > > - atomic_inc(&hp->refcnt); > > + refcount_inc(&hp->refcnt); > > spin_unlock_irqrestore(&mdesc_lock, flags); > > > > return hp; > > @@ -271,7 +272,7 @@ void mdesc_release(struct mdesc_handle *hp) > > unsigned long flags; > > > > spin_lock_irqsave(&mdesc_lock, flags); > > - if (atomic_dec_and_test(&hp->refcnt)) { > > + if (refcount_dec_and_test(&hp->refcnt)) { > > list_del_init(&hp->list); > > hp->mops->free(hp); > > } > > @@ -513,7 +514,7 @@ void mdesc_update(void) > > if (status != HV_EOK || real_len > len) { > > printk(KERN_ERR "MD: mdesc reread fails with %lu\n", > > status); > > - atomic_dec(&hp->refcnt); > > + refcount_dec(&hp->refcnt); > > mdesc_free(hp); > > goto out; > > } > > @@ -526,7 +527,7 @@ void mdesc_update(void) > > mdesc_notify_clients(orig_hp, hp); > > > > spin_lock_irqsave(&mdesc_lock, flags); > > - if (atomic_dec_and_test(&orig_hp->refcnt)) > > + if (refcount_dec_and_test(&orig_hp->refcnt)) > > mdesc_free(orig_hp); > > else > > list_add(&orig_hp->list, &mdesc_zombie_list); > >