From: Elena Reshetova <elena.reshetova@intel.com> To: linux-kernel@vger.kernel.org Cc: linux-cifs@vger.kernel.org, linux-nilfs@vger.kernel.org, paul@paul-moore.com, rlove@rlove.org, peterz@infradead.org, gregkh@linuxfoundation.org, Hans Liljestrand <ishkamiel@gmail.com>, sfrench@samba.org, linux-cachefs@redhat.com, viro@zeniv.linux.org.uk, konishi.ryusuke@lab.ntt.co.jp, linux-fsdevel@vger.kernel.org, eparis@parisplace.org, David Windsor <dwindsor@gmail.com>, john@johnmccutchan.com, Elena Reshetova <elena.reshetova@intel.com>, Kees Cook <keescook@chromium.org> Subject: [PATCH 10/10] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t Date: Thu, 2 Mar 2017 12:43:17 +0200 [thread overview] Message-ID: <1488451397-3365-11-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1488451397-3365-1-git-send-email-elena.reshetova@intel.com> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> --- fs/cifs/cifsglob.h | 5 +++-- fs/cifs/connect.c | 8 ++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 1a90bb3..bd27f92 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -28,6 +28,7 @@ #include "cifsacl.h" #include <crypto/internal/hash.h> #include <linux/scatterlist.h> +#include <linux/refcount.h> #include <uapi/linux/cifs/cifs_mount.h> #ifdef CONFIG_CIFS_SMB2 #include "smb2pdu.h" @@ -978,7 +979,7 @@ struct tcon_link { #define TCON_LINK_PENDING 1 #define TCON_LINK_IN_TREE 2 unsigned long tl_time; - atomic_t tl_count; + refcount_t tl_count; struct cifs_tcon *tl_tcon; }; @@ -996,7 +997,7 @@ static inline struct tcon_link * cifs_get_tlink(struct tcon_link *tlink) { if (tlink && !IS_ERR(tlink)) - atomic_inc(&tlink->tl_count); + refcount_inc(&tlink->tl_count); return tlink; } diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 777ad9f..e0f37ab 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2839,7 +2839,7 @@ cifs_put_tlink(struct tcon_link *tlink) if (!tlink || IS_ERR(tlink)) return; - if (!atomic_dec_and_test(&tlink->tl_count) || + if (!refcount_dec_and_test(&tlink->tl_count) || test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) { tlink->tl_time = jiffies; return; @@ -4302,7 +4302,7 @@ cifs_sb_tlink(struct cifs_sb_info *cifs_sb) newtlink->tl_tcon = ERR_PTR(-EACCES); set_bit(TCON_LINK_PENDING, &newtlink->tl_flags); set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags); - cifs_get_tlink(newtlink); + refcount_set(&newtlink->tl_count, 1); spin_lock(&cifs_sb->tlink_tree_lock); /* was one inserted after previous search? */ @@ -4380,11 +4380,11 @@ cifs_prune_tlinks(struct work_struct *work) tlink = rb_entry(tmp, struct tcon_link, tl_rbnode); if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) || - atomic_read(&tlink->tl_count) != 0 || + refcount_read(&tlink->tl_count) != 0 || time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies)) continue; - cifs_get_tlink(tlink); + refcount_set(&tlink->tl_count, 1); clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags); rb_erase(tmp, root); -- 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: Elena Reshetova <elena.reshetova@intel.com> To: linux-kernel@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-nilfs@vger.kernel.org, linux-cachefs@redhat.com, linux-cifs@vger.kernel.org, peterz@infradead.org, gregkh@linuxfoundation.org, viro@zeniv.linux.org.uk, dhowells@redhat.com, sfrench@samba.org, eparis@parisplace.org, konishi.ryusuke@lab.ntt.co.jp, john@johnmccutchan.com, rlove@rlove.org, paul@paul-moore.com, Elena Reshetova <elena.reshetova@intel.com>, Hans Liljestrand <ishkamiel@gmail.com>, Kees Cook <keescook@chromium.org>, David Windsor <dwindsor@gmail.com> Subject: [PATCH 10/10] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t Date: Thu, 2 Mar 2017 12:43:17 +0200 [thread overview] Message-ID: <1488451397-3365-11-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1488451397-3365-1-git-send-email-elena.reshetova@intel.com> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> --- fs/cifs/cifsglob.h | 5 +++-- fs/cifs/connect.c | 8 ++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 1a90bb3..bd27f92 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -28,6 +28,7 @@ #include "cifsacl.h" #include <crypto/internal/hash.h> #include <linux/scatterlist.h> +#include <linux/refcount.h> #include <uapi/linux/cifs/cifs_mount.h> #ifdef CONFIG_CIFS_SMB2 #include "smb2pdu.h" @@ -978,7 +979,7 @@ struct tcon_link { #define TCON_LINK_PENDING 1 #define TCON_LINK_IN_TREE 2 unsigned long tl_time; - atomic_t tl_count; + refcount_t tl_count; struct cifs_tcon *tl_tcon; }; @@ -996,7 +997,7 @@ static inline struct tcon_link * cifs_get_tlink(struct tcon_link *tlink) { if (tlink && !IS_ERR(tlink)) - atomic_inc(&tlink->tl_count); + refcount_inc(&tlink->tl_count); return tlink; } diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 777ad9f..e0f37ab 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2839,7 +2839,7 @@ cifs_put_tlink(struct tcon_link *tlink) if (!tlink || IS_ERR(tlink)) return; - if (!atomic_dec_and_test(&tlink->tl_count) || + if (!refcount_dec_and_test(&tlink->tl_count) || test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) { tlink->tl_time = jiffies; return; @@ -4302,7 +4302,7 @@ cifs_sb_tlink(struct cifs_sb_info *cifs_sb) newtlink->tl_tcon = ERR_PTR(-EACCES); set_bit(TCON_LINK_PENDING, &newtlink->tl_flags); set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags); - cifs_get_tlink(newtlink); + refcount_set(&newtlink->tl_count, 1); spin_lock(&cifs_sb->tlink_tree_lock); /* was one inserted after previous search? */ @@ -4380,11 +4380,11 @@ cifs_prune_tlinks(struct work_struct *work) tlink = rb_entry(tmp, struct tcon_link, tl_rbnode); if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) || - atomic_read(&tlink->tl_count) != 0 || + refcount_read(&tlink->tl_count) != 0 || time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies)) continue; - cifs_get_tlink(tlink); + refcount_set(&tlink->tl_count, 1); clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags); rb_erase(tmp, root); -- 2.7.4
next prev parent reply other threads:[~2017-03-02 10:43 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-03-02 10:43 [PATCH 00/10] various fs subsystems refcounter conversions Elena Reshetova 2017-03-02 10:43 ` [PATCH 02/10] fs, cachefiles: convert cachefiles_object.usage from atomic_t to refcount_t Elena Reshetova 2017-03-02 10:43 ` [PATCH 03/10] fs, proc: convert proc_dir_entry.count " Elena Reshetova 2017-03-02 10:43 ` [PATCH 04/10] fs, nilfs: convert nilfs_root.count " Elena Reshetova [not found] ` <1488451397-3365-1-git-send-email-elena.reshetova-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> 2017-03-02 10:43 ` [PATCH 01/10] fs, kernfs: convert kernfs_node.count " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova 2017-03-02 10:43 ` [PATCH 05/10] fs, hfs: convert hfs_bnode.refcnt " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova 2017-03-02 10:43 ` [PATCH 07/10] fs, fscache: convert fscache_operation.usage " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova 2017-03-02 10:43 ` [PATCH 08/10] fs, fsnotify: convert fsnotify_group.refcnt " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova 2017-03-02 10:43 ` [PATCH 06/10] fs, fscache: convert fscache_cache_tag.usage " Elena Reshetova 2017-03-02 10:43 ` [PATCH 09/10] fs, fsnotify: convert fsnotify_mark.refcnt " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova [this message] 2017-03-02 10:43 ` [PATCH 10/10] fs, cifs: convert tcon_link.tl_count " Elena Reshetova
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1488451397-3365-11-git-send-email-elena.reshetova@intel.com \ --to=elena.reshetova@intel.com \ --cc=dwindsor@gmail.com \ --cc=eparis@parisplace.org \ --cc=gregkh@linuxfoundation.org \ --cc=ishkamiel@gmail.com \ --cc=john@johnmccutchan.com \ --cc=keescook@chromium.org \ --cc=konishi.ryusuke@lab.ntt.co.jp \ --cc=linux-cachefs@redhat.com \ --cc=linux-cifs@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-nilfs@vger.kernel.org \ --cc=paul@paul-moore.com \ --cc=peterz@infradead.org \ --cc=rlove@rlove.org \ --cc=sfrench@samba.org \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.