Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1590988 > unrolled thread
| Started by | Elena Reshetova <elena.reshetova@intel.com> |
|---|---|
| First post | 2017-03-02 11:50 +0100 |
| Last post | 2017-03-02 13:30 +0100 |
| Articles | 2 — 1 participant |
Back to article view | Back to linux.kernel
[PATCH 00/10] various fs subsystems refcounter conversions Elena Reshetova <elena.reshetova@intel.com> - 2017-03-02 11:50 +0100
[PATCH 10/10] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-02 13:30 +0100
| From | Elena Reshetova <elena.reshetova@intel.com> |
|---|---|
| Date | 2017-03-02 11:50 +0100 |
| Subject | [PATCH 00/10] various fs subsystems refcounter conversions |
| Message-ID | <tgwt3-13g-3@gated-at.bofh.it> |
Now when new refcount_t type and API are finally merged
(see include/linux/refcount.h), the following
patches convert various refcounters in different fs susystems from atomic_t
to refcount_t. By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.
The below patches are fully independent and can be cherry-picked separately.
Since we convert all kernel subsystems in the same fashion, resulting
in about 300 patches, we have to group them for sending at least in some
fashion to be manageable. Please excuse the long cc list.
Elena Reshetova (10):
fs, kernfs: convert kernfs_node.count from atomic_t to refcount_t
fs, cachefiles: convert cachefiles_object.usage from atomic_t to
refcount_t
fs, proc: convert proc_dir_entry.count from atomic_t to refcount_t
fs, nilfs: convert nilfs_root.count from atomic_t to refcount_t
fs, hfs: convert hfs_bnode.refcnt from atomic_t to refcount_t
fs, fscache: convert fscache_cache_tag.usage from atomic_t to
refcount_t
fs, fscache: convert fscache_operation.usage from atomic_t to
refcount_t
fs, fsnotify: convert fsnotify_group.refcnt from atomic_t to
refcount_t
fs, fsnotify: convert fsnotify_mark.refcnt from atomic_t to refcount_t
fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t
fs/cachefiles/bind.c | 2 +-
fs/cachefiles/interface.c | 18 +++++++++---------
fs/cachefiles/internal.h | 3 ++-
fs/cachefiles/namei.c | 2 +-
fs/cachefiles/rdwr.c | 2 +-
fs/cifs/cifsglob.h | 5 +++--
fs/cifs/connect.c | 8 ++++----
fs/fscache/cache.c | 8 ++++----
fs/fscache/operation.c | 38 +++++++++++++++++++-------------------
fs/fscache/page.c | 2 +-
fs/hfs/bnode.c | 14 +++++++-------
fs/hfs/btree.c | 4 ++--
fs/hfs/btree.h | 3 ++-
fs/hfs/inode.c | 4 ++--
fs/hfsplus/bnode.c | 14 +++++++-------
fs/hfsplus/btree.c | 4 ++--
fs/hfsplus/hfsplus_fs.h | 3 ++-
fs/hfsplus/inode.c | 4 ++--
fs/kernfs/dir.c | 12 +++++-------
fs/nilfs2/the_nilfs.c | 8 ++++----
fs/nilfs2/the_nilfs.h | 5 +++--
fs/notify/group.c | 6 +++---
fs/notify/inotify/inotify_user.c | 4 ++--
fs/notify/mark.c | 6 +++---
fs/proc/generic.c | 4 ++--
fs/proc/internal.h | 5 +++--
fs/proc/root.c | 2 +-
include/linux/fscache-cache.h | 7 ++++---
include/linux/fsnotify_backend.h | 5 +++--
include/linux/kernfs.h | 3 ++-
kernel/audit_tree.c | 2 +-
31 files changed, 107 insertions(+), 100 deletions(-)
--
2.7.4
[toc] | [next] | [standalone]
| From | Elena Reshetova <elena.reshetova@intel.com> |
|---|---|
| Date | 2017-03-02 13:30 +0100 |
| Subject | [PATCH 10/10] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t |
| Message-ID | <tgy1P-2cX-13@gated-at.bofh.it> |
| In reply to | #1590988 |
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
fs/cifs/cifsglob.h | 5 +++--
fs/cifs/connect.c | 8 ++++----
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 1a90bb3..bd27f92 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -28,6 +28,7 @@
#include "cifsacl.h"
#include <crypto/internal/hash.h>
#include <linux/scatterlist.h>
+#include <linux/refcount.h>
#include <uapi/linux/cifs/cifs_mount.h>
#ifdef CONFIG_CIFS_SMB2
#include "smb2pdu.h"
@@ -978,7 +979,7 @@ struct tcon_link {
#define TCON_LINK_PENDING 1
#define TCON_LINK_IN_TREE 2
unsigned long tl_time;
- atomic_t tl_count;
+ refcount_t tl_count;
struct cifs_tcon *tl_tcon;
};
@@ -996,7 +997,7 @@ static inline struct tcon_link *
cifs_get_tlink(struct tcon_link *tlink)
{
if (tlink && !IS_ERR(tlink))
- atomic_inc(&tlink->tl_count);
+ refcount_inc(&tlink->tl_count);
return tlink;
}
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 777ad9f..e0f37ab 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2839,7 +2839,7 @@ cifs_put_tlink(struct tcon_link *tlink)
if (!tlink || IS_ERR(tlink))
return;
- if (!atomic_dec_and_test(&tlink->tl_count) ||
+ if (!refcount_dec_and_test(&tlink->tl_count) ||
test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
tlink->tl_time = jiffies;
return;
@@ -4302,7 +4302,7 @@ cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
newtlink->tl_tcon = ERR_PTR(-EACCES);
set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
- cifs_get_tlink(newtlink);
+ refcount_set(&newtlink->tl_count, 1);
spin_lock(&cifs_sb->tlink_tree_lock);
/* was one inserted after previous search? */
@@ -4380,11 +4380,11 @@ cifs_prune_tlinks(struct work_struct *work)
tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
- atomic_read(&tlink->tl_count) != 0 ||
+ refcount_read(&tlink->tl_count) != 0 ||
time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
continue;
- cifs_get_tlink(tlink);
+ refcount_set(&tlink->tl_count, 1);
clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
rb_erase(tmp, root);
--
2.7.4
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web