Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1610448 > unrolled thread
| Started by | Elena Reshetova <elena.reshetova@intel.com> |
|---|---|
| First post | 2017-03-28 11:10 +0200 |
| Last post | 2017-03-28 11:10 +0200 |
| Articles | 2 — 1 participant |
Back to article view | Back to linux.kernel
[PATCH 00/16] Networking drivers refcount conversions Elena Reshetova <elena.reshetova@intel.com> - 2017-03-28 11:10 +0200
[PATCH 07/16] drivers, net, mlx5: convert fs_node.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-03-28 11:10 +0200
| From | Elena Reshetova <elena.reshetova@intel.com> |
|---|---|
| Date | 2017-03-28 11:10 +0200 |
| Subject | [PATCH 00/16] Networking drivers refcount conversions |
| Message-ID | <tpV8T-535-29@gated-at.bofh.it> |
This series, for various different networking drivers, replaces atomic_t reference
counters with the new refcount_t type and API (see include/linux/refcount.h).
By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.
The below patches are fully independent and can be cherry-picked separately.
Since we convert all kernel subsystems in the same fashion, resulting
in about 300 patches, we have to group them for sending at least in some
fashion to be manageable. Please excuse the long cc list.
If there are no objections to these patches, please take them
through the relevant trees.
Elena Reshetova (16):
drivers, net, ethernet: convert clip_entry.refcnt from atomic_t to
refcount_t
drivers, net, ethernet: convert mtk_eth.dma_refcnt from atomic_t to
refcount_t
drivers, net, mlx4: convert mlx4_cq.refcount from atomic_t to
refcount_t
drivers, net, mlx4: convert mlx4_qp.refcount from atomic_t to
refcount_t
drivers, net, mlx4: convert mlx4_srq.refcount from atomic_t to
refcount_t
drivers, net, mlx5: convert mlx5_cq.refcount from atomic_t to
refcount_t
drivers, net, mlx5: convert fs_node.refcount from atomic_t to
refcount_t
drivers, net, hamradio: convert sixpack.refcnt from atomic_t to
refcount_t
drivers, net: convert masces_rx_sa.refcnt from atomic_t to refcount_t
drivers, net: convert masces_rx_sc.refcnt from atomic_t to refcount_t
drivers, net: convert masces_tx_sa.refcnt from atomic_t to refcount_t
drivers, net, ppp: convert asyncppp.refcnt from atomic_t to refcount_t
drivers, net, ppp: convert ppp_file.refcnt from atomic_t to refcount_t
drivers, net, ppp: convert syncppp.refcnt from atomic_t to refcount_t
drivers, net, intersil: convert hostap_cmd_queue.usecnt from atomic_t
to refcount_t
drivers, net, intersil: convert request_context.refcount from atomic_t
to refcount_t
drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c | 13 ++++++-----
drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h | 4 +++-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 ++++---
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 +++-
drivers/net/ethernet/mellanox/mlx4/cq.c | 8 +++----
drivers/net/ethernet/mellanox/mlx4/qp.c | 8 +++----
drivers/net/ethernet/mellanox/mlx4/srq.c | 8 +++----
drivers/net/ethernet/mellanox/mlx5/core/cq.c | 16 +++++++-------
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 24 ++++++++++-----------
drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 3 ++-
drivers/net/hamradio/6pack.c | 12 +++++------
drivers/net/macsec.c | 25 +++++++++++-----------
drivers/net/ppp/ppp_async.c | 10 ++++-----
drivers/net/ppp/ppp_generic.c | 17 ++++++++-------
drivers/net/ppp/ppp_synctty.c | 11 +++++-----
drivers/net/wireless/intersil/hostap/hostap_hw.c | 12 +++++------
drivers/net/wireless/intersil/hostap/hostap_wlan.h | 3 ++-
.../net/wireless/intersil/orinoco/orinoco_usb.c | 15 +++++++------
include/linux/mlx4/device.h | 8 +++----
include/linux/mlx5/cq.h | 4 ++--
20 files changed, 112 insertions(+), 101 deletions(-)
--
2.7.4
[toc] | [next] | [standalone]
| From | Elena Reshetova <elena.reshetova@intel.com> |
|---|---|
| Date | 2017-03-28 11:10 +0200 |
| Subject | [PATCH 07/16] drivers, net, mlx5: convert fs_node.refcount from atomic_t to refcount_t |
| Message-ID | <tpViz-5md-49@gated-at.bofh.it> |
| In reply to | #1610448 |
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 24 +++++++++++------------
drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 3 ++-
2 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 2478516..4f74d15 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -163,7 +163,7 @@ static void tree_init_node(struct fs_node *node,
unsigned int refcount,
void (*remove_func)(struct fs_node *))
{
- atomic_set(&node->refcount, refcount);
+ refcount_set(&node->refcount, refcount);
INIT_LIST_HEAD(&node->list);
INIT_LIST_HEAD(&node->children);
mutex_init(&node->lock);
@@ -173,7 +173,7 @@ static void tree_init_node(struct fs_node *node,
static void tree_add_node(struct fs_node *node, struct fs_node *parent)
{
if (parent)
- atomic_inc(&parent->refcount);
+ refcount_inc(&parent->refcount);
node->parent = parent;
/* Parent is the root */
@@ -185,7 +185,7 @@ static void tree_add_node(struct fs_node *node, struct fs_node *parent)
static void tree_get_node(struct fs_node *node)
{
- atomic_inc(&node->refcount);
+ refcount_inc(&node->refcount);
}
static void nested_lock_ref_node(struct fs_node *node,
@@ -193,7 +193,7 @@ static void nested_lock_ref_node(struct fs_node *node,
{
if (node) {
mutex_lock_nested(&node->lock, class);
- atomic_inc(&node->refcount);
+ refcount_inc(&node->refcount);
}
}
@@ -201,14 +201,14 @@ static void lock_ref_node(struct fs_node *node)
{
if (node) {
mutex_lock(&node->lock);
- atomic_inc(&node->refcount);
+ refcount_inc(&node->refcount);
}
}
static void unlock_ref_node(struct fs_node *node)
{
if (node) {
- atomic_dec(&node->refcount);
+ refcount_dec(&node->refcount);
mutex_unlock(&node->lock);
}
}
@@ -218,7 +218,7 @@ static void tree_put_node(struct fs_node *node)
struct fs_node *parent_node = node->parent;
lock_ref_node(parent_node);
- if (atomic_dec_and_test(&node->refcount)) {
+ if (refcount_dec_and_test(&node->refcount)) {
if (parent_node)
list_del_init(&node->list);
if (node->remove_func)
@@ -233,8 +233,8 @@ static void tree_put_node(struct fs_node *node)
static int tree_remove_node(struct fs_node *node)
{
- if (atomic_read(&node->refcount) > 1) {
- atomic_dec(&node->refcount);
+ if (refcount_read(&node->refcount) > 1) {
+ refcount_dec(&node->refcount);
return -EEXIST;
}
tree_put_node(node);
@@ -982,7 +982,7 @@ static void destroy_flow_handle(struct fs_fte *fte,
int i)
{
for (; --i >= 0;) {
- if (atomic_dec_and_test(&handle->rule[i]->node.refcount)) {
+ if (refcount_dec_and_test(&handle->rule[i]->node.refcount)) {
fte->dests_size--;
list_del(&handle->rule[i]->node.list);
kfree(handle->rule[i]);
@@ -1013,7 +1013,7 @@ create_flow_handle(struct fs_fte *fte,
if (dest) {
rule = find_flow_rule(fte, dest + i);
if (rule) {
- atomic_inc(&rule->node.refcount);
+ refcount_inc(&rule->node.refcount);
goto rule_found;
}
}
@@ -1282,7 +1282,7 @@ static struct mlx5_flow_handle *add_rule_fg(struct mlx5_flow_group *fg,
list_add(&fte->node.list, prev);
add_rules:
for (i = 0; i < handle->num_rules; i++) {
- if (atomic_read(&handle->rule[i]->node.refcount) == 1)
+ if (refcount_read(&handle->rule[i]->node.refcount) == 1)
tree_add_node(&handle->rule[i]->node, &fte->node);
}
unlock_fte:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 8e668c6..86bc743b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -33,6 +33,7 @@
#ifndef _MLX5_FS_CORE_
#define _MLX5_FS_CORE_
+#include <linux/refcount.h>
#include <linux/mlx5/fs.h>
enum fs_node_type {
@@ -80,7 +81,7 @@ struct fs_node {
struct fs_node *root;
/* lock the node for writing and traversing */
struct mutex lock;
- atomic_t refcount;
+ refcount_t refcount;
void (*remove_func)(struct fs_node *);
};
--
2.7.4
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web