From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932305AbdJWPUC (ORCPT ); Mon, 23 Oct 2017 11:20:02 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:48910 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932237AbdJWPUA (ORCPT ); Mon, 23 Oct 2017 11:20:00 -0400 Subject: Re: [PATCH] sparc64: convert mdesc_handle.refcnt from atomic_t to refcount_t To: "Reshetova, Elena" , "davem@davemloft.net" Cc: "linux-kernel@vger.kernel.org" , "sparclinux@vger.kernel.org" , "jag.raman@oracle.com" , "peterz@infradead.org" , "keescook@chromium.org" References: <1508486277-24913-1-git-send-email-elena.reshetova@intel.com> <519f48f1-3145-6bf4-469f-0c6059681287@oracle.com> <2236FBA76BA1254E88B949DDB74E612B802B4255@IRSMSX102.ger.corp.intel.com> From: Shannon Nelson Organization: Oracle Corporation Message-ID: <2331cc3d-7a89-a835-bfc2-cab1dd2df9c3@oracle.com> Date: Mon, 23 Oct 2017 08:19:20 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <2236FBA76BA1254E88B949DDB74E612B802B4255@IRSMSX102.ger.corp.intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/23/2017 12:10 AM, Reshetova, Elena wrote: >> On 10/20/2017 12:57 AM, Elena Reshetova wrote: >>> atomic_t variables are currently used to implement reference >>> counters with the following properties: >>> - counter is initialized to 1 using atomic_set() >>> - a resource is freed upon counter reaching zero >>> - once counter reaches zero, its further >>> increments aren't allowed >>> - counter schema uses basic atomic operations >>> (set, inc, inc_not_zero, dec_and_test, etc.) >>> >>> Such atomic variables should be converted to a newly provided >>> refcount_t type and API that prevents accidental counter overflows >>> and underflows. This is important since overflows and underflows >>> can lead to use-after-free situation and be exploitable. >>> >>> The variable mdesc_handle.refcnt is used as pure reference counter. >>> Convert it to refcount_t and fix up the operations. >>> >>> Suggested-by: Kees Cook >>> Reviewed-by: David Windsor >>> Reviewed-by: Hans Liljestrand >>> Signed-off-by: Elena Reshetova >> >> Acked-by: Shannon Nelson > > Thank you Shannon! Would you be able to take this patch into the respective tree > to propagate normally from there? > > Best Regards, > Elena. Hi Elena, Dave Miller takes good care of the sparclinux tree, I'm sure this is on his ToDo list already. sln