From: Elena Reshetova <elena.reshetova@intel.com>
To: linux-kernel@vger.kernel.org
Cc: cgroups@vger.kernel.org, linux-audit@redhat.com,
linux-fsdevel@vger.kernel.org, peterz@infradead.org,
gregkh@linuxfoundation.org, viro@zeniv.linux.org.uk,
tj@kernel.org, mingo@redhat.com, hannes@cmpxchg.org,
lizefan@huawei.com, acme@kernel.org,
alexander.shishkin@linux.intel.com, paul@paul-moore.com,
eparis@redhat.com, akpm@linux-foundation.org, arnd@arndb.de,
luto@kernel.org, Elena Reshetova <elena.reshetova@intel.com>,
Hans Liljestrand <ishkamiel@gmail.com>,
Kees Cook <keescook@chromium.org>,
David Windsor <dwindsor@gmail.com>
Subject: [PATCH 12/19] kernel: convert css_set.refcount from atomic_t to refcount_t
Date: Mon, 20 Feb 2017 12:19:01 +0200 [thread overview]
Message-ID: <1487585948-6401-13-git-send-email-elena.reshetova@intel.com> (raw)
In-Reply-To: <1487585948-6401-1-git-send-email-elena.reshetova@intel.com>
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
include/linux/cgroup-defs.h | 3 ++-
kernel/cgroup/cgroup-internal.h | 10 +++++++---
kernel/cgroup/cgroup-v1.c | 4 ++--
kernel/cgroup/cgroup.c | 8 ++++----
4 files changed, 15 insertions(+), 10 deletions(-)
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 3c02404..e2f4b31 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -13,6 +13,7 @@
#include <linux/wait.h>
#include <linux/mutex.h>
#include <linux/rcupdate.h>
+#include <linux/refcount.h>
#include <linux/percpu-refcount.h>
#include <linux/percpu-rwsem.h>
#include <linux/workqueue.h>
@@ -156,7 +157,7 @@ struct css_set {
struct cgroup_subsys_state *subsys[CGROUP_SUBSYS_COUNT];
/* reference count */
- atomic_t refcount;
+ refcount_t refcount;
/* the default cgroup associated with this css_set */
struct cgroup *dfl_cgrp;
diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h
index 9203bfb..22d87ca 100644
--- a/kernel/cgroup/cgroup-internal.h
+++ b/kernel/cgroup/cgroup-internal.h
@@ -5,6 +5,7 @@
#include <linux/kernfs.h>
#include <linux/workqueue.h>
#include <linux/list.h>
+#include <linux/refcount.h>
/*
* A cgroup can be associated with multiple css_sets as different tasks may
@@ -134,10 +135,13 @@ static inline void put_css_set(struct css_set *cset)
* can see it. Similar to atomic_dec_and_lock(), but for an
* rwlock
*/
- if (atomic_add_unless(&cset->refcount, -1, 1))
+ spin_lock_irqsave(&css_set_lock, flags);
+ if (refcount_read(&cset->refcount) != 1) {
+ WARN_ON(refcount_dec_and_test(&cset->refcount));
+ spin_unlock_irqrestore(&css_set_lock, flags);
return;
+ }
- spin_lock_irqsave(&css_set_lock, flags);
put_css_set_locked(cset);
spin_unlock_irqrestore(&css_set_lock, flags);
}
@@ -147,7 +151,7 @@ static inline void put_css_set(struct css_set *cset)
*/
static inline void get_css_set(struct css_set *cset)
{
- atomic_inc(&cset->refcount);
+ refcount_inc(&cset->refcount);
}
bool cgroup_ssid_enabled(int ssid);
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index fc34bcf..9269179 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -343,7 +343,7 @@ static int cgroup_task_count(const struct cgroup *cgrp)
spin_lock_irq(&css_set_lock);
list_for_each_entry(link, &cgrp->cset_links, cset_link)
- count += atomic_read(&link->cset->refcount);
+ count += refcount_read(&link->cset->refcount);
spin_unlock_irq(&css_set_lock);
return count;
}
@@ -1283,7 +1283,7 @@ static u64 current_css_set_refcount_read(struct cgroup_subsys_state *css,
u64 count;
rcu_read_lock();
- count = atomic_read(&task_css_set(current)->refcount);
+ count = refcount_read(&task_css_set(current)->refcount);
rcu_read_unlock();
return count;
}
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 5b94c79..59aba84 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -553,7 +553,7 @@ EXPORT_SYMBOL_GPL(of_css);
* haven't been created.
*/
struct css_set init_css_set = {
- .refcount = ATOMIC_INIT(1),
+ .refcount = REFCOUNT_INIT(1),
.tasks = LIST_HEAD_INIT(init_css_set.tasks),
.mg_tasks = LIST_HEAD_INIT(init_css_set.mg_tasks),
.task_iters = LIST_HEAD_INIT(init_css_set.task_iters),
@@ -723,7 +723,7 @@ void put_css_set_locked(struct css_set *cset)
lockdep_assert_held(&css_set_lock);
- if (!atomic_dec_and_test(&cset->refcount))
+ if (!refcount_dec_and_test(&cset->refcount))
return;
/* This css_set is dead. unlink it and release cgroup and css refs */
@@ -976,7 +976,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
return NULL;
}
- atomic_set(&cset->refcount, 1);
+ refcount_set(&cset->refcount, 1);
INIT_LIST_HEAD(&cset->tasks);
INIT_LIST_HEAD(&cset->mg_tasks);
INIT_LIST_HEAD(&cset->task_iters);
@@ -5064,4 +5064,4 @@ int cgroup_bpf_update(struct cgroup *cgrp, struct bpf_prog *prog,
mutex_unlock(&cgroup_mutex);
return ret;
}
-#endif /* CONFIG_CGROUP_BPF */
+#endif /* CONFIG_CGROUP_BPF */
\ No newline at end of file
--
2.7.4
next prev parent reply other threads:[~2017-02-20 10:25 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-20 10:18 [PATCH 00/19] Kernel subsystem refcounter conversions Elena Reshetova
2017-02-20 10:18 ` [PATCH 01/19] kernel: convert sighand_struct.count from atomic_t to refcount_t Elena Reshetova
2017-02-20 12:30 ` kbuild test robot
2017-02-20 12:42 ` kbuild test robot
2017-02-20 10:18 ` [PATCH 02/19] kernel: convert signal_struct.sigcnt " Elena Reshetova
2017-02-20 10:18 ` [PATCH 03/19] kernel: convert user_struct.__count " Elena Reshetova
2017-02-20 10:18 ` [PATCH 04/19] kernel: convert task_struct.usage " Elena Reshetova
2017-02-20 10:18 ` [PATCH 05/19] kernel: convert task_struct.stack_refcount " Elena Reshetova
2017-02-20 10:18 ` [PATCH 06/19] kernel: convert perf_event_context.refcount " Elena Reshetova
2017-02-20 10:28 ` Peter Zijlstra
2017-02-20 12:14 ` Reshetova, Elena
2017-02-20 10:18 ` [PATCH 07/19] kernel: convert ring_buffer.refcount " Elena Reshetova
2017-02-20 10:18 ` [PATCH 08/19] kernel: convert ring_buffer.aux_refcount " Elena Reshetova
2017-02-20 10:18 ` [PATCH 09/19] kernel: convert uprobe.ref " Elena Reshetova
2017-02-20 10:18 ` [PATCH 10/19] kernel: convert nsproxy.count " Elena Reshetova
2017-02-20 10:19 ` [PATCH 11/19] kernel: convert cgroup_namespace.count " Elena Reshetova
2017-03-06 19:55 ` Tejun Heo
2017-02-20 10:19 ` Elena Reshetova [this message]
2017-03-06 19:54 ` [PATCH 12/19] kernel: convert css_set.refcount " Tejun Heo
2017-03-07 19:12 ` Reshetova, Elena
2017-03-07 19:21 ` Tejun Heo
2017-02-20 10:19 ` [PATCH 13/19] kernel: convert group_info.usage " Elena Reshetova
2017-02-20 10:19 ` [PATCH 14/19] kernel: convert cred.usage " Elena Reshetova
2017-02-20 10:19 ` [PATCH 15/19] kernel: convert audit_tree.count " Elena Reshetova
2017-02-20 22:07 ` Paul Moore
2017-02-21 7:15 ` Reshetova, Elena
2017-02-28 22:11 ` Paul Moore
2017-03-01 0:16 ` Kees Cook
2017-03-01 19:35 ` Paul Moore
2017-03-01 23:04 ` Kees Cook
2017-04-11 19:01 ` Paul Moore
2017-04-18 6:33 ` Reshetova, Elena
2017-02-20 10:19 ` [PATCH 16/19] kernel: convert audit_watch.count " Elena Reshetova
2017-02-20 10:19 ` [PATCH 17/19] kernel: convert numa_group.refcount " Elena Reshetova
2017-02-20 10:19 ` [PATCH 18/19] kernel: convert futex_pi_state.refcount " Elena Reshetova
2017-02-20 10:19 ` [PATCH 19/19] kernel: convert kcov.refcount " Elena Reshetova
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1487585948-6401-13-git-send-email-elena.reshetova@intel.com \
--to=elena.reshetova@intel.com \
--cc=acme@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=alexander.shishkin@linux.intel.com \
--cc=arnd@arndb.de \
--cc=cgroups@vger.kernel.org \
--cc=dwindsor@gmail.com \
--cc=eparis@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=hannes@cmpxchg.org \
--cc=ishkamiel@gmail.com \
--cc=keescook@chromium.org \
--cc=linux-audit@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan@huawei.com \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=paul@paul-moore.com \
--cc=peterz@infradead.org \
--cc=tj@kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).