Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1724842

Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to refcount_t

Show all headers | View raw

On Wed, 30 Aug 2017, Elena Reshetova wrote:
> atomic_t variables are currently used to implement reference
> counters with the following properties:
>  - counter is initialized to 1 using atomic_set()
>  - a resource is freed upon counter reaching zero
>  - once counter reaches zero, its further
>    increments aren't allowed
>  - counter schema uses basic atomic operations
>    (set, inc, inc_not_zero, dec_and_test, etc.)
> 
> Such atomic variables should be converted to a newly provided
> refcount_t type and API that prevents accidental counter overflows
> and underflows. This is important since overflows and underflows
> can lead to use-after-free situation and be exploitable.
> 
> The variable futex_pi_state.refcount is used as pure
> reference counter. Convert it to refcount_t and fix up
> the operations.
> 
> Suggested-by: Kees Cook <keescook@chromium.org>
> Reviewed-by: David Windsor <dwindsor@gmail.com>
> Reviewed-by: Hans Liljestrand <ishkamiel@gmail.com>
> Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>

Reviewed-by: Thomas Gleixner <tglx@linutronix.de>

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/15] v5 kernel core pieces refcount conversions Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 05/15] sched/task_struct: convert task_struct.usage to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 10/15] uprobes: convert uprobe.ref to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 14/15] futex: convert futex_pi_state.refcount to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
    Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Thomas Gleixner <tglx@linutronix.de> - 2017-09-01 09:50 +0200
      Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 11:40 +0200
        Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Thomas Gleixner <tglx@linutronix.de> - 2017-09-01 11:50 +0200
          RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 13:00 +0200
          RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 13:10 +0200
            Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 14:40 +0200
              RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 15:30 +0200
                Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 15:40 +0200
                RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 19:10 +0200
                Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-01 21:20 +0200
                RE: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-04 12:40 +0200
                Re: [PATCH 14/15] futex: convert futex_pi_state.refcount to  refcount_t Peter Zijlstra <peterz@infradead.org> - 2017-09-04 14:10 +0200
  [PATCH 07/15] perf: convert perf_event_context.refcount to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 03/15] sched: convert user_struct.__count to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  [PATCH 11/15] nsproxy: convert nsproxy.count to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-08-30 14:30 +0200
  Re: [PATCH 00/15] v5 kernel core pieces refcount conversions Kees Cook <keescook@chromium.org> - 2017-09-01 01:50 +0200
    Re: [PATCH 00/15] v5 kernel core pieces refcount conversions Peter Zijlstra <peterz@infradead.org> - 2017-09-01 11:50 +0200
      Re: [PATCH 00/15] v5 kernel core pieces refcount conversions Kees Cook <keescook@chromium.org> - 2017-09-01 19:00 +0200
        RE: [PATCH 00/15] v5 kernel core pieces refcount conversions "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-09-01 19:10 +0200

csiph-web