Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1724966

RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to refcount_t

Show all headers | View raw

> On Fri, 1 Sep 2017, Peter Zijlstra wrote:
> > On Fri, Sep 01, 2017 at 09:39:50AM +0200, Thomas Gleixner wrote:
> > > On Wed, 30 Aug 2017, Elena Reshetova wrote:
> > > > atomic_t variables are currently used to implement reference
> > > > counters with the following properties:
> > > >  - counter is initialized to 1 using atomic_set()
> > > >  - a resource is freed upon counter reaching zero
> > > >  - once counter reaches zero, its further
> > > >    increments aren't allowed
> > > >  - counter schema uses basic atomic operations
> > > >    (set, inc, inc_not_zero, dec_and_test, etc.)
> > > >
> > > > Such atomic variables should be converted to a newly provided
> > > > refcount_t type and API that prevents accidental counter overflows
> > > > and underflows. This is important since overflows and underflows
> > > > can lead to use-after-free situation and be exploitable.
> > > >
> > > > The variable futex_pi_state.refcount is used as pure
> > > > reference counter. Convert it to refcount_t and fix up
> > > > the operations.
> > > >
> > > > Suggested-by: Kees Cook <keescook@chromium.org>
> > > > Reviewed-by: David Windsor <dwindsor@gmail.com>
> > > > Reviewed-by: Hans Liljestrand <ishkamiel@gmail.com>
> > > > Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
> > >
> > > Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
> >
> > So the thing to be careful with for things like futex and some of the
> > other core kernel code is the memory ordering.
> >
> > atomic_dec_and_test() provides a full smp_mb() before and after,
> > refcount_dec_and_test() only provides release semantics.
> >
> > This is typically sufficient, and I would argue that if we rely on more
> > than that, there _should_ be a comment, however reality isn't always as
> > nice.
> >
> > That said, I think this conversion is OK, pi_state->refcount isn't
> > relied upon to provide additional memory ordering above and beyond what
> > refcounting requires.
> 
> So the changelogs should reflect that. The current one suggests that this
> is a one to one replacement for atomic_t just with the extra sanity checks
> added.

I will update the commit texts accordingly and resend the whole series since
this should be then mentioned in every commit to make sure it is not missed.

Best Regards,
Elena.

> 
> Thanks,
> 
> 	tglx

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/15] v5 kernel core pieces refcount conversions Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 05/15] sched/task_struct: convert task_struct.usage to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 10/15] uprobes: convert uprobe.ref to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 14/15] futex: convert futex_pi_state.refcount to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
    Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Thomas Gleixner <tglx@linutronix.de> - 2017-09-01 09:50 +0200
      Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 11:40 +0200
        Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Thomas Gleixner <tglx@linutronix.de> - 2017-09-01 11:50 +0200
          RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 13:00 +0200
          RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 13:10 +0200
            Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 14:40 +0200
              RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 15:30 +0200
                Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 15:40 +0200
                RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 19:10 +0200
                Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 21:20 +0200
                RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-04 12:40 +0200
                Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-04 14:10 +0200
  [PATCH 07/15] perf: convert perf_event_context.refcount to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 03/15] sched: convert user_struct.__count to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 11/15] nsproxy: convert nsproxy.count to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  Re: [PATCH 00/15] v5 kernel core pieces refcount conversions Kees Cook <keescook@chromium.org> - 2017-09-01 01:50 +0200
    Re: [PATCH 00/15] v5 kernel core pieces refcount conversions Peter Zijlstra <peterz@infradead.org> - 2017-09-01 11:50 +0200
      Re: [PATCH 00/15] v5 kernel core pieces refcount conversions Kees Cook <keescook@chromium.org> - 2017-09-01 19:00 +0200
        RE: [PATCH 00/15] v5 kernel core pieces refcount conversions "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 19:10 +0200

csiph-web