* [PATCH] drivers, scsi: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t
@ 2017-03-09 7:44 Elena Reshetova
2017-03-15 23:07 ` Martin K. Petersen
0 siblings, 1 reply; 2+ messages in thread
From: Elena Reshetova @ 2017-03-09 7:44 UTC (permalink / raw)
To: jth
Cc: jejb, martin.petersen, linux-scsi, fcoe-devel, linux-kernel,
Elena Reshetova, Hans Liljestrand, Kees Cook, David Windsor
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Acked-by: Johannes Thumshirn <jth@kernel.org>
---
drivers/scsi/libfc/fc_fcp.c | 6 +++---
include/scsi/libfc.h | 3 ++-
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index 0e67621..a808e8e 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -154,7 +154,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lport, gfp_t gfp)
memset(fsp, 0, sizeof(*fsp));
fsp->lp = lport;
fsp->xfer_ddp = FC_XID_UNKNOWN;
- atomic_set(&fsp->ref_cnt, 1);
+ refcount_set(&fsp->ref_cnt, 1);
init_timer(&fsp->timer);
fsp->timer.data = (unsigned long)fsp;
INIT_LIST_HEAD(&fsp->list);
@@ -175,7 +175,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lport, gfp_t gfp)
*/
static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
{
- if (atomic_dec_and_test(&fsp->ref_cnt)) {
+ if (refcount_dec_and_test(&fsp->ref_cnt)) {
struct fc_fcp_internal *si = fc_get_scsi_internal(fsp->lp);
mempool_free(fsp, si->scsi_pkt_pool);
@@ -188,7 +188,7 @@ static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
*/
static void fc_fcp_pkt_hold(struct fc_fcp_pkt *fsp)
{
- atomic_inc(&fsp->ref_cnt);
+ refcount_inc(&fsp->ref_cnt);
}
/**
diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
index da5033d..2109844 100644
--- a/include/scsi/libfc.h
+++ b/include/scsi/libfc.h
@@ -23,6 +23,7 @@
#include <linux/timer.h>
#include <linux/if.h>
#include <linux/percpu.h>
+#include <linux/refcount.h>
#include <scsi/scsi_transport.h>
#include <scsi/scsi_transport_fc.h>
@@ -321,7 +322,7 @@ struct fc_seq_els_data {
*/
struct fc_fcp_pkt {
spinlock_t scsi_pkt_lock;
- atomic_t ref_cnt;
+ refcount_t ref_cnt;
/* SCSI command and data transfer information */
u32 data_len;
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drivers, scsi: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t
2017-03-09 7:44 [PATCH] drivers, scsi: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t Elena Reshetova
@ 2017-03-15 23:07 ` Martin K. Petersen
0 siblings, 0 replies; 2+ messages in thread
From: Martin K. Petersen @ 2017-03-15 23:07 UTC (permalink / raw)
To: Elena Reshetova
Cc: jth, jejb, martin.petersen, linux-scsi, fcoe-devel, linux-kernel,
Hans Liljestrand, Kees Cook, David Windsor
Elena Reshetova <elena.reshetova@intel.com> writes:
> refcount_t type and corresponding API should be used instead of
> atomic_t when the variable is used as a reference counter. This allows
> to avoid accidental refcounter overflows that might lead to
> use-after-free situations.
Applied to 4.12/scsi-queue.
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-03-15 23:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-09 7:44 [PATCH] drivers, scsi: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t Elena Reshetova
2017-03-15 23:07 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).