All of lore.kernel.org
 help / color / mirror / Atom feed
From: Elena Reshetova <elena.reshetova@intel.com>
To: trond.myklebust@primarydata.com
Cc: linux-kernel@vger.kernel.org, linux-nfs@vger.kernel.org,
	anna.schumaker@netapp.com, bfields@fieldses.org,
	jlayton@poochiereds.net, peterz@infradead.org,
	keescook@chromium.org,
	Elena Reshetova <elena.reshetova@intel.com>
Subject: [PATCH 08/11] fs, nfs: convert nfs_cache_defer_req.count from atomic_t to refcount_t
Date: Fri, 20 Oct 2017 12:53:35 +0300	[thread overview]
Message-ID: <1508493218-27760-9-git-send-email-elena.reshetova@intel.com> (raw)
In-Reply-To: <1508493218-27760-1-git-send-email-elena.reshetova@intel.com>

atomic_t variables are currently used to implement reference
counters with the following properties:
 - counter is initialized to 1 using atomic_set()
 - a resource is freed upon counter reaching zero
 - once counter reaches zero, its further
   increments aren't allowed
 - counter schema uses basic atomic operations
   (set, inc, inc_not_zero, dec_and_test, etc.)

Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.

The variable nfs_cache_defer_req.count is used as pure reference counter.
Convert it to refcount_t and fix up the operations.

Suggested-by: Kees Cook <keescook@chromium.org>
Reviewed-by: David Windsor <dwindsor@gmail.com>
Reviewed-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
 fs/nfs/cache_lib.c | 6 +++---
 fs/nfs/cache_lib.h | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/cache_lib.c b/fs/nfs/cache_lib.c
index 2ae676f..6167f13 100644
--- a/fs/nfs/cache_lib.c
+++ b/fs/nfs/cache_lib.c
@@ -66,7 +66,7 @@ int nfs_cache_upcall(struct cache_detail *cd, char *entry_name)
  */
 void nfs_cache_defer_req_put(struct nfs_cache_defer_req *dreq)
 {
-	if (atomic_dec_and_test(&dreq->count))
+	if (refcount_dec_and_test(&dreq->count))
 		kfree(dreq);
 }
 
@@ -86,7 +86,7 @@ static struct cache_deferred_req *nfs_dns_cache_defer(struct cache_req *req)
 
 	dreq = container_of(req, struct nfs_cache_defer_req, req);
 	dreq->deferred_req.revisit = nfs_dns_cache_revisit;
-	atomic_inc(&dreq->count);
+	refcount_inc(&dreq->count);
 
 	return &dreq->deferred_req;
 }
@@ -98,7 +98,7 @@ struct nfs_cache_defer_req *nfs_cache_defer_req_alloc(void)
 	dreq = kzalloc(sizeof(*dreq), GFP_KERNEL);
 	if (dreq) {
 		init_completion(&dreq->completion);
-		atomic_set(&dreq->count, 1);
+		refcount_set(&dreq->count, 1);
 		dreq->req.defer = nfs_dns_cache_defer;
 	}
 	return dreq;
diff --git a/fs/nfs/cache_lib.h b/fs/nfs/cache_lib.h
index 4116d2c..02b378c 100644
--- a/fs/nfs/cache_lib.h
+++ b/fs/nfs/cache_lib.h
@@ -15,7 +15,7 @@ struct nfs_cache_defer_req {
 	struct cache_req req;
 	struct cache_deferred_req deferred_req;
 	struct completion completion;
-	atomic_t count;
+	refcount_t count;
 };
 
 extern int nfs_cache_upcall(struct cache_detail *cd, char *entry_name);
-- 
2.7.4

  parent reply	other threads:[~2017-10-20  9:56 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-20  9:53 [PATCH 00/11] nfs refcount conversions Elena Reshetova
2017-10-20  9:53 ` [PATCH 01/11] fs, nfsd: convert nfs4_stid.sc_count from atomic_t to refcount_t Elena Reshetova
2017-10-20  9:53 ` [PATCH 02/11] fs, nfsd: convert nfs4_cntl_odstate.co_odcount " Elena Reshetova
2017-10-20  9:53 ` [PATCH 03/11] fs, nfsd: convert nfs4_file.fi_ref " Elena Reshetova
2017-10-20  9:53 ` [PATCH 04/11] fs, nfs: convert nfs4_pnfs_ds.ds_count " Elena Reshetova
2017-10-20  9:53 ` [PATCH 05/11] fs, nfs: convert pnfs_layout_segment.pls_refcount " Elena Reshetova
2017-10-20  9:53 ` [PATCH 06/11] fs, nfs: convert pnfs_layout_hdr.plh_refcount " Elena Reshetova
2017-10-20  9:53 ` [PATCH 07/11] fs, nfs: convert nfs4_ff_layout_mirror.ref " Elena Reshetova
2017-10-20  9:53 ` Elena Reshetova [this message]
2017-10-20  9:53 ` [PATCH 09/11] fs, nfs: convert nfs4_lock_state.ls_count " Elena Reshetova
2017-10-20  9:53 ` [PATCH 10/11] fs, nfs: convert nfs_lock_context.count " Elena Reshetova
2017-10-20  9:53 ` [PATCH 11/11] fs, nfs: convert nfs_client.cl_count " Elena Reshetova
2017-10-20 18:59 ` [PATCH 00/11] nfs refcount conversions J. Bruce Fields
2017-10-23  7:30   ` Reshetova, Elena

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1508493218-27760-9-git-send-email-elena.reshetova@intel.com \
    --to=elena.reshetova@intel.com \
    --cc=anna.schumaker@netapp.com \
    --cc=bfields@fieldses.org \
    --cc=jlayton@poochiereds.net \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-nfs@vger.kernel.org \
    --cc=peterz@infradead.org \
    --cc=trond.myklebust@primarydata.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.