From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751552AbdIAHkG (ORCPT ); Fri, 1 Sep 2017 03:40:06 -0400 Received: from Galois.linutronix.de ([146.0.238.70]:35919 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751398AbdIAHkE (ORCPT ); Fri, 1 Sep 2017 03:40:04 -0400 Date: Fri, 1 Sep 2017 09:39:50 +0200 (CEST) From: Thomas Gleixner To: Elena Reshetova cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, peterz@infradead.org, gregkh@linuxfoundation.org, viro@zeniv.linux.org.uk, tj@kernel.org, mingo@redhat.com, hannes@cmpxchg.org, lizefan@huawei.com, acme@kernel.org, alexander.shishkin@linux.intel.com, eparis@redhat.com, akpm@linux-foundation.org, arnd@arndb.de, luto@kernel.org, keescook@chromium.org, dvhart@infradead.org, ebiederm@xmission.com Subject: Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to refcount_t In-Reply-To: <1504095773-22895-15-git-send-email-elena.reshetova@intel.com> Message-ID: References: <1504095773-22895-1-git-send-email-elena.reshetova@intel.com> <1504095773-22895-15-git-send-email-elena.reshetova@intel.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 30 Aug 2017, Elena Reshetova wrote: > atomic_t variables are currently used to implement reference > counters with the following properties: > - counter is initialized to 1 using atomic_set() > - a resource is freed upon counter reaching zero > - once counter reaches zero, its further > increments aren't allowed > - counter schema uses basic atomic operations > (set, inc, inc_not_zero, dec_and_test, etc.) > > Such atomic variables should be converted to a newly provided > refcount_t type and API that prevents accidental counter overflows > and underflows. This is important since overflows and underflows > can lead to use-after-free situation and be exploitable. > > The variable futex_pi_state.refcount is used as pure > reference counter. Convert it to refcount_t and fix up > the operations. > > Suggested-by: Kees Cook > Reviewed-by: David Windsor > Reviewed-by: Hans Liljestrand > Signed-off-by: Elena Reshetova Reviewed-by: Thomas Gleixner