From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752221AbdCDAf4 (ORCPT ); Fri, 3 Mar 2017 19:35:56 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:45404 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752064AbdCDAfz (ORCPT ); Fri, 3 Mar 2017 19:35:55 -0500 Date: Fri, 3 Mar 2017 16:23:52 -0800 From: Andrew Morton To: Elena Reshetova Cc: linux-kernel@vger.kernel.org, peterz@infradead.org, gregkh@linuxfoundation.org, ebiederm@xmission.com, mingo@redhat.com, adobriyan@gmail.com, serge@hallyn.com, arozansk@redhat.com, dave@stgolabs.net Subject: Re: [PATCH 0/3] ipc subsystem refcounter conversions Message-Id: <20170303162352.b6af1c0c3115b3f5f1e7aed3@linux-foundation.org> In-Reply-To: <1487590189-18151-1-git-send-email-elena.reshetova@intel.com> References: <1487590189-18151-1-git-send-email-elena.reshetova@intel.com> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 20 Feb 2017 13:29:46 +0200 Elena Reshetova wrote: > Now when new refcount_t type and API are finally merged > (see include/linux/refcount.h), the following > patches convert various refcounters in the ipc susystem from atomic_t > to refcount_t. By doing this we prevent intentional or accidental > underflows or overflows that can led to use-after-free vulnerabilities. > > The below patches are fully independent and can be cherry-picked separately. > Since we convert all kernel subsystems in the same fashion, resulting > in about 300 patches, we have to group them for sending at least in some > fashion to be manageable. Please excuse the long cc list. Again, the refcount_t operations are much more expensive than the bare atomic_t operations. I'm reluctant to merge any of these conversions without either a) a convincing demonstration that the performance impact is sufficiently small (ie: unmeasurable) or b) a compile-time option to disable the refcount_t operations (make them generate the same code as the bare atomic_t ops). Along with some suitably reliable means of preventing people from accidentally enabling the debug code in production builds.