On Mon, 2016-11-14 at 12:31 -0800, Kees Cook wrote:
> On Fri, Nov 11, 2016 at 12:17 PM, Peter Zijlstra <peterz@infradead.or
> g> wrote:
> > 
> > On Fri, Nov 11, 2016 at 10:04:42AM -0800, Kees Cook wrote:
> > 
> > > 
> > > I'm totally open about how to get there, but things can't just be
> > > opt-in.
> > There really is no alternative.
> I realize you feel that way, but if we can find a way to squeeze
> mistakes down to impossible or very small, that has a strong effect
> on
> the future of avoiding exploitation of these kinds of things.
> 
> > 
> > refcount_t; should only have: inc, inc_not_zero, dec_and_test
> Sounds good. Two questions remain:
> 
> - how to deal with existing refcounting atomic_t users that want _add
> and _sub?
> - keeping this fast enough that it can be used even in very sensitive
> places (net, fs, etc).
> 
> > 
> > stats_t; should only have: add,sub
> Seems right, though why not inc/dec? And shouldn't it have a _read of
> some kind?
> 
> Keeping the implementation details of refcount_t and stats_t opaque
> to
> the users should discourage misuse...

I suspect a lack of inc_not_zero and dec_and_test would
be the biggest things discouraging misuse of stats_t
for reference counting :)

-- 
All rights reversed