From: Elena Reshetova <elena.reshetova@intel.com>
To: trond.myklebust@primarydata.com
Cc: linux-kernel@vger.kernel.org, linux-nfs@vger.kernel.org,
anna.schumaker@netapp.com, peterz@infradead.org,
keescook@chromium.org,
Elena Reshetova <elena.reshetova@intel.com>,
Hans Liljestrand <ishkamiel@gmail.com>,
David Windsor <dwindsor@gmail.com>
Subject: [PATCH 07/12] fs, nfs: convert nfs4_ff_layout_mirror.ref from atomic_t to refcount_t
Date: Tue, 14 Mar 2017 09:07:15 +0200 [thread overview]
Message-ID: <1489475240-6594-8-git-send-email-elena.reshetova@intel.com> (raw)
In-Reply-To: <1489475240-6594-1-git-send-email-elena.reshetova@intel.com>
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 8 ++++----
fs/nfs/flexfilelayout/flexfilelayout.h | 3 ++-
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index d6acc68..18d4c5a 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -187,7 +187,7 @@ ff_layout_add_mirror(struct pnfs_layout_hdr *lo,
continue;
if (!ff_mirror_match_fh(mirror, pos))
continue;
- if (atomic_inc_not_zero(&pos->ref)) {
+ if (refcount_inc_not_zero(&pos->ref)) {
spin_unlock(&inode->i_lock);
return pos;
}
@@ -218,7 +218,7 @@ static struct nfs4_ff_layout_mirror *ff_layout_alloc_mirror(gfp_t gfp_flags)
mirror = kzalloc(sizeof(*mirror), gfp_flags);
if (mirror != NULL) {
spin_lock_init(&mirror->lock);
- atomic_set(&mirror->ref, 1);
+ refcount_set(&mirror->ref, 1);
INIT_LIST_HEAD(&mirror->mirrors);
}
return mirror;
@@ -242,7 +242,7 @@ static void ff_layout_free_mirror(struct nfs4_ff_layout_mirror *mirror)
static void ff_layout_put_mirror(struct nfs4_ff_layout_mirror *mirror)
{
- if (mirror != NULL && atomic_dec_and_test(&mirror->ref))
+ if (mirror != NULL && refcount_dec_and_test(&mirror->ref))
ff_layout_free_mirror(mirror);
}
@@ -2325,7 +2325,7 @@ ff_layout_mirror_prepare_stats(struct pnfs_layout_hdr *lo,
if (!test_and_clear_bit(NFS4_FF_MIRROR_STAT_AVAIL, &mirror->flags))
continue;
/* mirror refcount put in cleanup_layoutstats */
- if (!atomic_inc_not_zero(&mirror->ref))
+ if (!refcount_inc_not_zero(&mirror->ref))
continue;
dev = &mirror->mirror_ds->id_node;
memcpy(&devinfo->dev_id, &dev->deviceid, NFS4_DEVICEID4_SIZE);
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index f4f39b0..1b5d60b 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -13,6 +13,7 @@
#define FF_FLAGS_NO_IO_THRU_MDS 2
#define FF_FLAGS_NO_READ_IO 4
+#include <linux/refcount.h>
#include "../pnfs.h"
/* XXX: Let's filter out insanely large mirror count for now to avoid oom
@@ -81,7 +82,7 @@ struct nfs4_ff_layout_mirror {
nfs4_stateid stateid;
struct rpc_cred __rcu *ro_cred;
struct rpc_cred __rcu *rw_cred;
- atomic_t ref;
+ refcount_t ref;
spinlock_t lock;
unsigned long flags;
struct nfs4_ff_layoutstat read_stat;
--
2.7.4
next prev parent reply other threads:[~2017-03-14 7:07 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-14 7:07 [PATCH 00/12] fs, nfs conversions from atomic_t to refcount_t Elena Reshetova
2017-03-14 7:07 ` [PATCH 01/12] fs, nfsd: convert nfs4_stid.sc_count " Elena Reshetova
2017-03-14 7:07 ` [PATCH 02/12] fs, nfsd: convert nfs4_cntl_odstate.co_odcount " Elena Reshetova
2017-03-14 7:07 ` [PATCH 03/12] fs, nfsd: convert nfs4_file.fi_ref " Elena Reshetova
2017-03-14 7:07 ` [PATCH 04/12] fs, nfs: convert nfs4_pnfs_ds.ds_count " Elena Reshetova
2017-03-14 7:07 ` [PATCH 05/12] fs, nfs: convert pnfs_layout_segment.pls_refcount " Elena Reshetova
2017-03-14 7:07 ` [PATCH 06/12] fs, nfs: convert pnfs_layout_hdr.plh_refcount " Elena Reshetova
2017-03-14 7:07 ` Elena Reshetova [this message]
2017-03-14 7:07 ` [PATCH 08/12] fs, nfs: convert nfs_cache_defer_req.count " Elena Reshetova
2017-03-14 7:07 ` [PATCH 09/12] fs, nfs: convert nfs4_lock_state.ls_count " Elena Reshetova
2017-03-14 7:07 ` [PATCH 10/12] fs, nfs: convert nfs_lock_context.count " Elena Reshetova
2017-03-14 7:07 ` [PATCH 11/12] fs, nfs: convert nfs_client.cl_count " Elena Reshetova
2017-03-14 7:07 ` [PATCH 12/12] fs, nfs: convert nfs_cache_array.refcount " Elena Reshetova
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1489475240-6594-8-git-send-email-elena.reshetova@intel.com \
--to=elena.reshetova@intel.com \
--cc=anna.schumaker@netapp.com \
--cc=dwindsor@gmail.com \
--cc=ishkamiel@gmail.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=peterz@infradead.org \
--cc=trond.myklebust@primarydata.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.