Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1590988 > unrolled thread

[PATCH 00/10] various fs subsystems refcounter conversions

Started byElena Reshetova <elena.reshetova@intel.com>
First post2017-03-02 11:50 +0100
Last post2017-03-02 13:30 +0100
Articles 2 — 1 participant

Back to article view | Back to linux.kernel


Contents

  [PATCH 00/10] various fs subsystems refcounter conversions Elena Reshetova <elena.reshetova@intel.com> - 2017-03-02 11:50 +0100
    [PATCH 10/10] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-02 13:30 +0100

#1590988 — [PATCH 00/10] various fs subsystems refcounter conversions

FromElena Reshetova <elena.reshetova@intel.com>
Date2017-03-02 11:50 +0100
Subject[PATCH 00/10] various fs subsystems refcounter conversions
Message-ID<tgwt3-13g-3@gated-at.bofh.it>
Now when new refcount_t type and API are finally merged
(see include/linux/refcount.h), the following
patches convert various refcounters in different fs susystems from atomic_t
to refcount_t. By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.

The below patches are fully independent and can be cherry-picked separately.
Since we convert all kernel subsystems in the same fashion, resulting
in about 300 patches, we have to group them for sending at least in some
fashion to be manageable. Please excuse the long cc list.

Elena Reshetova (10):
  fs, kernfs: convert kernfs_node.count from atomic_t to refcount_t
  fs, cachefiles: convert cachefiles_object.usage from atomic_t to
    refcount_t
  fs, proc: convert proc_dir_entry.count from atomic_t to refcount_t
  fs, nilfs: convert nilfs_root.count from atomic_t to refcount_t
  fs, hfs: convert hfs_bnode.refcnt from atomic_t to refcount_t
  fs, fscache: convert fscache_cache_tag.usage from atomic_t to
    refcount_t
  fs, fscache: convert fscache_operation.usage from atomic_t to
    refcount_t
  fs, fsnotify: convert fsnotify_group.refcnt from atomic_t to
    refcount_t
  fs, fsnotify: convert fsnotify_mark.refcnt from atomic_t to refcount_t
  fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t

 fs/cachefiles/bind.c             |  2 +-
 fs/cachefiles/interface.c        | 18 +++++++++---------
 fs/cachefiles/internal.h         |  3 ++-
 fs/cachefiles/namei.c            |  2 +-
 fs/cachefiles/rdwr.c             |  2 +-
 fs/cifs/cifsglob.h               |  5 +++--
 fs/cifs/connect.c                |  8 ++++----
 fs/fscache/cache.c               |  8 ++++----
 fs/fscache/operation.c           | 38 +++++++++++++++++++-------------------
 fs/fscache/page.c                |  2 +-
 fs/hfs/bnode.c                   | 14 +++++++-------
 fs/hfs/btree.c                   |  4 ++--
 fs/hfs/btree.h                   |  3 ++-
 fs/hfs/inode.c                   |  4 ++--
 fs/hfsplus/bnode.c               | 14 +++++++-------
 fs/hfsplus/btree.c               |  4 ++--
 fs/hfsplus/hfsplus_fs.h          |  3 ++-
 fs/hfsplus/inode.c               |  4 ++--
 fs/kernfs/dir.c                  | 12 +++++-------
 fs/nilfs2/the_nilfs.c            |  8 ++++----
 fs/nilfs2/the_nilfs.h            |  5 +++--
 fs/notify/group.c                |  6 +++---
 fs/notify/inotify/inotify_user.c |  4 ++--
 fs/notify/mark.c                 |  6 +++---
 fs/proc/generic.c                |  4 ++--
 fs/proc/internal.h               |  5 +++--
 fs/proc/root.c                   |  2 +-
 include/linux/fscache-cache.h    |  7 ++++---
 include/linux/fsnotify_backend.h |  5 +++--
 include/linux/kernfs.h           |  3 ++-
 kernel/audit_tree.c              |  2 +-
 31 files changed, 107 insertions(+), 100 deletions(-)

-- 
2.7.4

[toc] | [next] | [standalone]


#1591032 — [PATCH 10/10] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t

FromElena Reshetova <elena.reshetova@intel.com>
Date2017-03-02 13:30 +0100
Subject[PATCH 10/10] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t
Message-ID<tgy1P-2cX-13@gated-at.bofh.it>
In reply to#1590988
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
 fs/cifs/cifsglob.h | 5 +++--
 fs/cifs/connect.c  | 8 ++++----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 1a90bb3..bd27f92 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -28,6 +28,7 @@
 #include "cifsacl.h"
 #include <crypto/internal/hash.h>
 #include <linux/scatterlist.h>
+#include <linux/refcount.h>
 #include <uapi/linux/cifs/cifs_mount.h>
 #ifdef CONFIG_CIFS_SMB2
 #include "smb2pdu.h"
@@ -978,7 +979,7 @@ struct tcon_link {
 #define TCON_LINK_PENDING	1
 #define TCON_LINK_IN_TREE	2
 	unsigned long		tl_time;
-	atomic_t		tl_count;
+	refcount_t		tl_count;
 	struct cifs_tcon	*tl_tcon;
 };
 
@@ -996,7 +997,7 @@ static inline struct tcon_link *
 cifs_get_tlink(struct tcon_link *tlink)
 {
 	if (tlink && !IS_ERR(tlink))
-		atomic_inc(&tlink->tl_count);
+		refcount_inc(&tlink->tl_count);
 	return tlink;
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 777ad9f..e0f37ab 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2839,7 +2839,7 @@ cifs_put_tlink(struct tcon_link *tlink)
 	if (!tlink || IS_ERR(tlink))
 		return;
 
-	if (!atomic_dec_and_test(&tlink->tl_count) ||
+	if (!refcount_dec_and_test(&tlink->tl_count) ||
 	    test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
 		tlink->tl_time = jiffies;
 		return;
@@ -4302,7 +4302,7 @@ cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
 		newtlink->tl_tcon = ERR_PTR(-EACCES);
 		set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
 		set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
-		cifs_get_tlink(newtlink);
+		refcount_set(&newtlink->tl_count, 1);
 
 		spin_lock(&cifs_sb->tlink_tree_lock);
 		/* was one inserted after previous search? */
@@ -4380,11 +4380,11 @@ cifs_prune_tlinks(struct work_struct *work)
 		tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
 
 		if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
-		    atomic_read(&tlink->tl_count) != 0 ||
+		    refcount_read(&tlink->tl_count) != 0 ||
 		    time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
 			continue;
 
-		cifs_get_tlink(tlink);
+		refcount_set(&tlink->tl_count, 1);
 		clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
 		rb_erase(tmp, root);
 
-- 
2.7.4

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web