Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1600067

[PATCH 03/12] fs, nfsd: convert nfs4_file.fi_ref from atomic_t to refcount_t

From Elena Reshetova <elena.reshetova@intel.com>
Newsgroups linux.kernel
Subject [PATCH 03/12] fs, nfsd: convert nfs4_file.fi_ref from atomic_t to refcount_t
Date 2017-03-14 08:10 +0100
Message-ID <tkOKL-4Zd-31@gated-at.bofh.it> (permalink)
References <tkOKJ-4Zd-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
 fs/nfsd/nfs4state.c | 6 +++---
 fs/nfsd/state.h     | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 253fc93..a19f56c 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -359,7 +359,7 @@ put_nfs4_file(struct nfs4_file *fi)
 {
 	might_lock(&state_lock);
 
-	if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
+	if (refcount_dec_and_lock(&fi->fi_ref, &state_lock)) {
 		hlist_del_rcu(&fi->fi_hash);
 		spin_unlock(&state_lock);
 		WARN_ON_ONCE(!list_empty(&fi->fi_clnt_odstate));
@@ -3352,7 +3352,7 @@ static void nfsd4_init_file(struct knfsd_fh *fh, unsigned int hashval,
 {
 	lockdep_assert_held(&state_lock);
 
-	atomic_set(&fp->fi_ref, 1);
+	refcount_set(&fp->fi_ref, 1);
 	spin_lock_init(&fp->fi_lock);
 	INIT_LIST_HEAD(&fp->fi_stateids);
 	INIT_LIST_HEAD(&fp->fi_delegations);
@@ -3648,7 +3648,7 @@ find_file_locked(struct knfsd_fh *fh, unsigned int hashval)
 
 	hlist_for_each_entry_rcu(fp, &file_hashtbl[hashval], fi_hash) {
 		if (fh_match(&fp->fi_fhandle, fh)) {
-			if (atomic_inc_not_zero(&fp->fi_ref))
+			if (refcount_inc_not_zero(&fp->fi_ref))
 				return fp;
 		}
 	}
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 58eb5f4..4797429 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -482,7 +482,7 @@ struct nfs4_clnt_odstate {
  * the global state_lock spinlock.
  */
 struct nfs4_file {
-	atomic_t		fi_ref;
+	refcount_t		fi_ref;
 	spinlock_t		fi_lock;
 	struct hlist_node       fi_hash;	/* hash on fi_fhandle */
 	struct list_head        fi_stateids;
@@ -635,7 +635,7 @@ struct nfs4_file *find_file(struct knfsd_fh *fh);
 void put_nfs4_file(struct nfs4_file *fi);
 static inline void get_nfs4_file(struct nfs4_file *fi)
 {
-	atomic_inc(&fi->fi_ref);
+	refcount_inc(&fi->fi_ref);
 }
 struct file *find_any_file(struct nfs4_file *f);
 
-- 
2.7.4

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 00/12] fs, nfs conversions from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 10/12] fs, nfs: convert nfs_lock_context.count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 11/12] fs, nfs: convert nfs_client.cl_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 12/12] fs, nfs: convert nfs_cache_array.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 07/12] fs, nfs: convert nfs4_ff_layout_mirror.ref from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 08/12] fs, nfs: convert nfs_cache_defer_req.count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 01/12] fs, nfsd: convert nfs4_stid.sc_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 05/12] fs, nfs: convert pnfs_layout_segment.pls_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 03/12] fs, nfsd: convert nfs4_file.fi_ref from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 06/12] fs, nfs: convert pnfs_layout_hdr.plh_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100
  [PATCH 09/12] fs, nfs: convert nfs4_lock_state.ls_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100
  [PATCH 04/12] fs, nfs: convert nfs4_pnfs_ds.ds_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100
  [PATCH 02/12] fs, nfsd: convert nfs4_cntl_odstate.co_odcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100

csiph-web