Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1600073

[PATCH 02/12] fs, nfsd: convert nfs4_cntl_odstate.co_odcount from atomic_t to refcount_t

Show all headers | View raw

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
 fs/nfsd/nfs4state.c | 6 +++---
 fs/nfsd/state.h     | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index ea1ce57..253fc93 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -568,7 +568,7 @@ alloc_clnt_odstate(struct nfs4_client *clp)
 	co = kmem_cache_zalloc(odstate_slab, GFP_KERNEL);
 	if (co) {
 		co->co_client = clp;
-		atomic_set(&co->co_odcount, 1);
+		refcount_set(&co->co_odcount, 1);
 	}
 	return co;
 }
@@ -586,7 +586,7 @@ static inline void
 get_clnt_odstate(struct nfs4_clnt_odstate *co)
 {
 	if (co)
-		atomic_inc(&co->co_odcount);
+		refcount_inc(&co->co_odcount);
 }
 
 static void
@@ -598,7 +598,7 @@ put_clnt_odstate(struct nfs4_clnt_odstate *co)
 		return;
 
 	fp = co->co_file;
-	if (atomic_dec_and_lock(&co->co_odcount, &fp->fi_lock)) {
+	if (refcount_dec_and_lock(&co->co_odcount, &fp->fi_lock)) {
 		list_del(&co->co_perfile);
 		spin_unlock(&fp->fi_lock);
 
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index f927aa4..58eb5f4 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -466,7 +466,7 @@ struct nfs4_clnt_odstate {
 	struct nfs4_client	*co_client;
 	struct nfs4_file	*co_file;
 	struct list_head	co_perfile;
-	atomic_t		co_odcount;
+	refcount_t		co_odcount;
 };
 
 /*
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH 00/12] fs, nfs conversions from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 10/12] fs, nfs: convert nfs_lock_context.count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 11/12] fs, nfs: convert nfs_client.cl_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 12/12] fs, nfs: convert nfs_cache_array.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 07/12] fs, nfs: convert nfs4_ff_layout_mirror.ref from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 08/12] fs, nfs: convert nfs_cache_defer_req.count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 01/12] fs, nfsd: convert nfs4_stid.sc_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 05/12] fs, nfs: convert pnfs_layout_segment.pls_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 03/12] fs, nfsd: convert nfs4_file.fi_ref from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:10 +0100
  [PATCH 06/12] fs, nfs: convert pnfs_layout_hdr.plh_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100
  [PATCH 09/12] fs, nfs: convert nfs4_lock_state.ls_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100
  [PATCH 04/12] fs, nfs: convert nfs4_pnfs_ds.ds_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100
  [PATCH 02/12] fs, nfsd: convert nfs4_cntl_odstate.co_odcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-14 08:20 +0100

csiph-web