From: Elena Reshetova <elena.reshetova-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> To: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-nilfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-cachefs-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, peterz-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org, gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org, viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org, dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, sfrench-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org, eparis-FjpueFixGhCM4zKIHC2jIg@public.gmane.org, konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org, john-jueV0HHMeujJJrXXpGQQMAC/G2K4zDHf@public.gmane.org, rlove-L7G0xEPcOZbYtjvyW6yDsg@public.gmane.org, paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org, Elena Reshetova <elena.reshetova-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>, Hans Liljestrand <ishkamiel-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>, Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>, David Windsor <dwindsor-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> Subject: [PATCH 01/10] fs, kernfs: convert kernfs_node.count from atomic_t to refcount_t Date: Thu, 2 Mar 2017 12:43:08 +0200 [thread overview] Message-ID: <1488451397-3365-2-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1488451397-3365-1-git-send-email-elena.reshetova-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> Signed-off-by: Hans Liljestrand <ishkamiel-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> Signed-off-by: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org> Signed-off-by: David Windsor <dwindsor-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> --- fs/kernfs/dir.c | 12 +++++------- include/linux/kernfs.h | 3 ++- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index db5900aaa..2a07de1 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -489,10 +489,8 @@ static void kernfs_drain(struct kernfs_node *kn) */ void kernfs_get(struct kernfs_node *kn) { - if (kn) { - WARN_ON(!atomic_read(&kn->count)); - atomic_inc(&kn->count); - } + if (kn) + refcount_inc(&kn->count); } EXPORT_SYMBOL_GPL(kernfs_get); @@ -507,7 +505,7 @@ void kernfs_put(struct kernfs_node *kn) struct kernfs_node *parent; struct kernfs_root *root; - if (!kn || !atomic_dec_and_test(&kn->count)) + if (!kn || !refcount_dec_and_test(&kn->count)) return; root = kernfs_root(kn); repeat: @@ -538,7 +536,7 @@ void kernfs_put(struct kernfs_node *kn) kn = parent; if (kn) { - if (atomic_dec_and_test(&kn->count)) + if (refcount_dec_and_test(&kn->count)) goto repeat; } else { /* just released the root kn, free @root too */ @@ -635,7 +633,7 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, goto err_out2; kn->ino = ret; - atomic_set(&kn->count, 1); + refcount_set(&kn->count, 1); atomic_set(&kn->active, KN_DEACTIVATED_BIAS); RB_CLEAR_NODE(&kn->rb); diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h index a9b11b8..baabbaf 100644 --- a/include/linux/kernfs.h +++ b/include/linux/kernfs.h @@ -15,6 +15,7 @@ #include <linux/lockdep.h> #include <linux/rbtree.h> #include <linux/atomic.h> +#include <linux/refcount.h> #include <linux/wait.h> struct file; @@ -105,7 +106,7 @@ struct kernfs_elem_attr { * active reference. */ struct kernfs_node { - atomic_t count; + refcount_t count; atomic_t active; #ifdef CONFIG_DEBUG_LOCK_ALLOC struct lockdep_map dep_map; -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-nilfs" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html
WARNING: multiple messages have this Message-ID (diff)
From: Elena Reshetova <elena.reshetova@intel.com> To: linux-kernel@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-nilfs@vger.kernel.org, linux-cachefs@redhat.com, linux-cifs@vger.kernel.org, peterz@infradead.org, gregkh@linuxfoundation.org, viro@zeniv.linux.org.uk, dhowells@redhat.com, sfrench@samba.org, eparis@parisplace.org, konishi.ryusuke@lab.ntt.co.jp, john@johnmccutchan.com, rlove@rlove.org, paul@paul-moore.com, Elena Reshetova <elena.reshetova@intel.com>, Hans Liljestrand <ishkamiel@gmail.com>, Kees Cook <keescook@chromium.org>, David Windsor <dwindsor@gmail.com> Subject: [PATCH 01/10] fs, kernfs: convert kernfs_node.count from atomic_t to refcount_t Date: Thu, 2 Mar 2017 12:43:08 +0200 [thread overview] Message-ID: <1488451397-3365-2-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1488451397-3365-1-git-send-email-elena.reshetova@intel.com> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> --- fs/kernfs/dir.c | 12 +++++------- include/linux/kernfs.h | 3 ++- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index db5900aaa..2a07de1 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -489,10 +489,8 @@ static void kernfs_drain(struct kernfs_node *kn) */ void kernfs_get(struct kernfs_node *kn) { - if (kn) { - WARN_ON(!atomic_read(&kn->count)); - atomic_inc(&kn->count); - } + if (kn) + refcount_inc(&kn->count); } EXPORT_SYMBOL_GPL(kernfs_get); @@ -507,7 +505,7 @@ void kernfs_put(struct kernfs_node *kn) struct kernfs_node *parent; struct kernfs_root *root; - if (!kn || !atomic_dec_and_test(&kn->count)) + if (!kn || !refcount_dec_and_test(&kn->count)) return; root = kernfs_root(kn); repeat: @@ -538,7 +536,7 @@ void kernfs_put(struct kernfs_node *kn) kn = parent; if (kn) { - if (atomic_dec_and_test(&kn->count)) + if (refcount_dec_and_test(&kn->count)) goto repeat; } else { /* just released the root kn, free @root too */ @@ -635,7 +633,7 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, goto err_out2; kn->ino = ret; - atomic_set(&kn->count, 1); + refcount_set(&kn->count, 1); atomic_set(&kn->active, KN_DEACTIVATED_BIAS); RB_CLEAR_NODE(&kn->rb); diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h index a9b11b8..baabbaf 100644 --- a/include/linux/kernfs.h +++ b/include/linux/kernfs.h @@ -15,6 +15,7 @@ #include <linux/lockdep.h> #include <linux/rbtree.h> #include <linux/atomic.h> +#include <linux/refcount.h> #include <linux/wait.h> struct file; @@ -105,7 +106,7 @@ struct kernfs_elem_attr { * active reference. */ struct kernfs_node { - atomic_t count; + refcount_t count; atomic_t active; #ifdef CONFIG_DEBUG_LOCK_ALLOC struct lockdep_map dep_map; -- 2.7.4
next prev parent reply other threads:[~2017-03-02 10:43 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-03-02 10:43 [PATCH 00/10] various fs subsystems refcounter conversions Elena Reshetova 2017-03-02 10:43 ` [PATCH 02/10] fs, cachefiles: convert cachefiles_object.usage from atomic_t to refcount_t Elena Reshetova 2017-03-02 10:43 ` [PATCH 03/10] fs, proc: convert proc_dir_entry.count " Elena Reshetova 2017-03-02 10:43 ` [PATCH 04/10] fs, nilfs: convert nilfs_root.count " Elena Reshetova [not found] ` <1488451397-3365-1-git-send-email-elena.reshetova-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> 2017-03-02 10:43 ` Elena Reshetova [this message] 2017-03-02 10:43 ` [PATCH 01/10] fs, kernfs: convert kernfs_node.count " Elena Reshetova 2017-03-02 10:43 ` [PATCH 05/10] fs, hfs: convert hfs_bnode.refcnt " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova 2017-03-02 10:43 ` [PATCH 07/10] fs, fscache: convert fscache_operation.usage " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova 2017-03-02 10:43 ` [PATCH 08/10] fs, fsnotify: convert fsnotify_group.refcnt " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova 2017-03-02 10:43 ` [PATCH 06/10] fs, fscache: convert fscache_cache_tag.usage " Elena Reshetova 2017-03-02 10:43 ` [PATCH 09/10] fs, fsnotify: convert fsnotify_mark.refcnt " Elena Reshetova 2017-03-02 10:43 ` [PATCH 10/10] fs, cifs: convert tcon_link.tl_count " Elena Reshetova 2017-03-02 10:43 ` Elena Reshetova
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1488451397-3365-2-git-send-email-elena.reshetova@intel.com \ --to=elena.reshetova-ral2jqcrhueavxtiumwx3w@public.gmane.org \ --cc=dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \ --cc=dwindsor-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \ --cc=eparis-FjpueFixGhCM4zKIHC2jIg@public.gmane.org \ --cc=gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org \ --cc=ishkamiel-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \ --cc=john-jueV0HHMeujJJrXXpGQQMAC/G2K4zDHf@public.gmane.org \ --cc=keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org \ --cc=konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org \ --cc=linux-cachefs-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \ --cc=linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=linux-nilfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org \ --cc=peterz-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org \ --cc=rlove-L7G0xEPcOZbYtjvyW6yDsg@public.gmane.org \ --cc=sfrench-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org \ --cc=viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.