Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1603263

[PATCH 10/23] net, rds: convert rds_message.m_refcount from atomic_t to refcount_t

Show all headers | View raw

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
 net/rds/message.c | 12 ++++++------
 net/rds/rds.h     |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/rds/message.c b/net/rds/message.c
index 49bfb51..4318cc9 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -48,8 +48,8 @@ static unsigned int	rds_exthdr_size[__RDS_EXTHDR_MAX] = {
 
 void rds_message_addref(struct rds_message *rm)
 {
-	rdsdebug("addref rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-	atomic_inc(&rm->m_refcount);
+	rdsdebug("addref rm %p ref %d\n", rm, refcount_read(&rm->m_refcount));
+	refcount_inc(&rm->m_refcount);
 }
 EXPORT_SYMBOL_GPL(rds_message_addref);
 
@@ -83,9 +83,9 @@ static void rds_message_purge(struct rds_message *rm)
 
 void rds_message_put(struct rds_message *rm)
 {
-	rdsdebug("put rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-	WARN(!atomic_read(&rm->m_refcount), "danger refcount zero on %p\n", rm);
-	if (atomic_dec_and_test(&rm->m_refcount)) {
+	rdsdebug("put rm %p ref %d\n", rm, refcount_read(&rm->m_refcount));
+	WARN(!refcount_read(&rm->m_refcount), "danger refcount zero on %p\n", rm);
+	if (refcount_dec_and_test(&rm->m_refcount)) {
 		BUG_ON(!list_empty(&rm->m_sock_item));
 		BUG_ON(!list_empty(&rm->m_conn_item));
 		rds_message_purge(rm);
@@ -206,7 +206,7 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
 	rm->m_used_sgs = 0;
 	rm->m_total_sgs = extra_len / sizeof(struct scatterlist);
 
-	atomic_set(&rm->m_refcount, 1);
+	refcount_set(&rm->m_refcount, 1);
 	INIT_LIST_HEAD(&rm->m_sock_item);
 	INIT_LIST_HEAD(&rm->m_conn_item);
 	spin_lock_init(&rm->m_rs_lock);
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 7487597..8c205ff 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -355,7 +355,7 @@ static inline u32 rds_rdma_cookie_offset(rds_rdma_cookie_t cookie)
 #define RDS_MSG_FLUSH		8
 
 struct rds_message {
-	atomic_t		m_refcount;
+	refcount_t		m_refcount;
 	struct list_head	m_sock_item;
 	struct list_head	m_conn_item;
 	struct rds_incoming	m_inc;
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/23] various networking refcount conversions, part 2 Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
  [PATCH 16/23] net, sctp: convert sctp_auth_bytes.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
  [PATCH 07/23] net, rds: convert rds_ib_device.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
  [PATCH 14/23] net, xfrm: convert xfrm_policy.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
  [PATCH 02/23] net, sunrpc: convert gss_cl_ctx.count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
  [PATCH 06/23] net, ceph: convert ceph_pagelist.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
    Re: [PATCH 06/23] net, ceph: convert ceph_pagelist.refcnt from  atomic_t to refcount_t Ilya Dryomov <idryomov@gmail.com> - 2017-03-24 15:00 +0100
  [PATCH 08/23] net, rds: convert rds_incoming.i_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
  [PATCH 05/23] net, ceph: convert ceph_osd.o_ref from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:20 +0100
    Re: [PATCH 05/23] net, ceph: convert ceph_osd.o_ref from atomic_t to refcount_t Ilya Dryomov <idryomov@gmail.com> - 2017-03-24 15:00 +0100
  [PATCH 21/23] net, ax25: convert ax25_uid_assoc.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 15/23] net, xfrm: convert sec_path.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 23/23] net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 10/23] net, rds: convert rds_message.m_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 09/23] net, rds: convert rds_mr.r_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 12/23] net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 19/23] net, sctp: convert sctp_transport.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 11/23] net, x25: convert x25_route.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 13/23] net, xfrm: convert xfrm_state.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100
  [PATCH 18/23] net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-17 13:30 +0100

csiph-web