| Message ID | 1621590825-60693-13-git-send-email-liweihang@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | RDMA: Use refcount_t for reference counting | expand |
On Fri, May 21, 2021 at 7:35 PM Weihang Li <liweihang@huawei.com> wrote: > > The refcount_t API will WARN on underflow and overflow of a reference > counter, and avoid use-after-free risks. > > Cc: Faisal Latif <faisal.latif@intel.com> > Cc: Shiraz Saleem <shiraz.saleem@intel.com> > Signed-off-by: Weihang Li <liweihang@huawei.com> > --- > drivers/infiniband/hw/i40iw/i40iw.h | 2 +- > drivers/infiniband/hw/i40iw/i40iw_main.c | 2 +- > drivers/infiniband/hw/i40iw/i40iw_utils.c | 10 +++++----- https://patchwork.kernel.org/project/linux-rdma/patch/20210520143809.819-22-shiraz.saleem@intel.com/ In this commit, i40iw will be removed. And this commit will be merged into upstream linux. Not sure if this commit makes sense. > 3 files changed, 7 insertions(+), 7 deletions(-) > > diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h > index be4094a..15c5dd6 100644 > --- a/drivers/infiniband/hw/i40iw/i40iw.h > +++ b/drivers/infiniband/hw/i40iw/i40iw.h > @@ -137,7 +137,7 @@ struct i40iw_cqp_request { > struct cqp_commands_info info; > wait_queue_head_t waitq; > struct list_head list; > - atomic_t refcount; > + refcount_t refcount; > void (*callback_fcn)(struct i40iw_cqp_request*, u32); > void *param; > struct i40iw_cqp_compl_info compl_info; > diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c > index b496f30..fc48555 100644 > --- a/drivers/infiniband/hw/i40iw/i40iw_main.c > +++ b/drivers/infiniband/hw/i40iw/i40iw_main.c > @@ -1125,7 +1125,7 @@ static enum i40iw_status_code i40iw_alloc_local_mac_ipaddr_entry(struct i40iw_de > } > > /* increment refcount, because we need the cqp request ret value */ > - atomic_inc(&cqp_request->refcount); > + refcount_inc(&cqp_request->refcount); > > cqp_info = &cqp_request->info; > cqp_info->cqp_cmd = OP_ALLOC_LOCAL_MAC_IPADDR_ENTRY; > diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c > index 9ff825f..32ff432b 100644 > --- a/drivers/infiniband/hw/i40iw/i40iw_utils.c > +++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c > @@ -384,10 +384,10 @@ struct i40iw_cqp_request *i40iw_get_cqp_request(struct i40iw_cqp *cqp, bool wait > } > > if (wait) { > - atomic_set(&cqp_request->refcount, 2); > + refcount_set(&cqp_request->refcount, 2); > cqp_request->waiting = true; > } else { > - atomic_set(&cqp_request->refcount, 1); > + refcount_set(&cqp_request->refcount, 1); > } > return cqp_request; > } > @@ -424,7 +424,7 @@ void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp > void i40iw_put_cqp_request(struct i40iw_cqp *cqp, > struct i40iw_cqp_request *cqp_request) > { > - if (atomic_dec_and_test(&cqp_request->refcount)) > + if (refcount_dec_and_test(&cqp_request->refcount)) > i40iw_free_cqp_request(cqp, cqp_request); > } > > @@ -445,7 +445,7 @@ static void i40iw_free_pending_cqp_request(struct i40iw_cqp *cqp, > } > i40iw_put_cqp_request(cqp, cqp_request); > wait_event_timeout(iwdev->close_wq, > - !atomic_read(&cqp_request->refcount), > + !refcount_read(&cqp_request->refcount), > 1000); > } > > @@ -1005,7 +1005,7 @@ static void i40iw_cqp_manage_hmc_fcn_callback(struct i40iw_cqp_request *cqp_requ > > if (hmcfcninfo && hmcfcninfo->callback_fcn) { > i40iw_debug(&iwdev->sc_dev, I40IW_DEBUG_HMC, "%s1\n", __func__); > - atomic_inc(&cqp_request->refcount); > + refcount_inc(&cqp_request->refcount); > work = &iwdev->virtchnl_w[hmcfcninfo->iw_vf_idx]; > work->cqp_request = cqp_request; > INIT_WORK(&work->work, i40iw_cqp_manage_hmc_fcn_worker); > -- > 2.7.4 >
On 2021/5/22 17:42, Zhu Yanjun wrote: > On Fri, May 21, 2021 at 7:35 PM Weihang Li <liweihang@huawei.com> wrote: >> >> The refcount_t API will WARN on underflow and overflow of a reference >> counter, and avoid use-after-free risks. >> >> Cc: Faisal Latif <faisal.latif@intel.com> >> Cc: Shiraz Saleem <shiraz.saleem@intel.com> >> Signed-off-by: Weihang Li <liweihang@huawei.com> >> --- >> drivers/infiniband/hw/i40iw/i40iw.h | 2 +- >> drivers/infiniband/hw/i40iw/i40iw_main.c | 2 +- >> drivers/infiniband/hw/i40iw/i40iw_utils.c | 10 +++++----- > > https://patchwork.kernel.org/project/linux-rdma/patch/20210520143809.819-22-shiraz.saleem@intel.com/ > > In this commit, i40iw will be removed. And this commit will be merged > into upstream linux. > Not sure if this commit makes sense. > I see, changes on i40iw will be dropped from this series, thanks. Weihang >> 3 files changed, 7 insertions(+), 7 deletions(-) >> >> diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h >> index be4094a..15c5dd6 100644 >> --- a/drivers/infiniband/hw/i40iw/i40iw.h >> +++ b/drivers/infiniband/hw/i40iw/i40iw.h >> @@ -137,7 +137,7 @@ struct i40iw_cqp_request { >> struct cqp_commands_info info; >> wait_queue_head_t waitq; >> struct list_head list; >> - atomic_t refcount; >> + refcount_t refcount; >> void (*callback_fcn)(struct i40iw_cqp_request*, u32); >> void *param; >> struct i40iw_cqp_compl_info compl_info; >> diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c >> index b496f30..fc48555 100644 >> --- a/drivers/infiniband/hw/i40iw/i40iw_main.c >> +++ b/drivers/infiniband/hw/i40iw/i40iw_main.c >> @@ -1125,7 +1125,7 @@ static enum i40iw_status_code i40iw_alloc_local_mac_ipaddr_entry(struct i40iw_de >> } >> >> /* increment refcount, because we need the cqp request ret value */ >> - atomic_inc(&cqp_request->refcount); >> + refcount_inc(&cqp_request->refcount); >> >> cqp_info = &cqp_request->info; >> cqp_info->cqp_cmd = OP_ALLOC_LOCAL_MAC_IPADDR_ENTRY; >> diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c >> index 9ff825f..32ff432b 100644 >> --- a/drivers/infiniband/hw/i40iw/i40iw_utils.c >> +++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c >> @@ -384,10 +384,10 @@ struct i40iw_cqp_request *i40iw_get_cqp_request(struct i40iw_cqp *cqp, bool wait >> } >> >> if (wait) { >> - atomic_set(&cqp_request->refcount, 2); >> + refcount_set(&cqp_request->refcount, 2); >> cqp_request->waiting = true; >> } else { >> - atomic_set(&cqp_request->refcount, 1); >> + refcount_set(&cqp_request->refcount, 1); >> } >> return cqp_request; >> } >> @@ -424,7 +424,7 @@ void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp >> void i40iw_put_cqp_request(struct i40iw_cqp *cqp, >> struct i40iw_cqp_request *cqp_request) >> { >> - if (atomic_dec_and_test(&cqp_request->refcount)) >> + if (refcount_dec_and_test(&cqp_request->refcount)) >> i40iw_free_cqp_request(cqp, cqp_request); >> } >> >> @@ -445,7 +445,7 @@ static void i40iw_free_pending_cqp_request(struct i40iw_cqp *cqp, >> } >> i40iw_put_cqp_request(cqp, cqp_request); >> wait_event_timeout(iwdev->close_wq, >> - !atomic_read(&cqp_request->refcount), >> + !refcount_read(&cqp_request->refcount), >> 1000); >> } >> >> @@ -1005,7 +1005,7 @@ static void i40iw_cqp_manage_hmc_fcn_callback(struct i40iw_cqp_request *cqp_requ >> >> if (hmcfcninfo && hmcfcninfo->callback_fcn) { >> i40iw_debug(&iwdev->sc_dev, I40IW_DEBUG_HMC, "%s1\n", __func__); >> - atomic_inc(&cqp_request->refcount); >> + refcount_inc(&cqp_request->refcount); >> work = &iwdev->virtchnl_w[hmcfcninfo->iw_vf_idx]; >> work->cqp_request = cqp_request; >> INIT_WORK(&work->work, i40iw_cqp_manage_hmc_fcn_worker); >> -- >> 2.7.4 >> >
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h index be4094a..15c5dd6 100644 --- a/drivers/infiniband/hw/i40iw/i40iw.h +++ b/drivers/infiniband/hw/i40iw/i40iw.h @@ -137,7 +137,7 @@ struct i40iw_cqp_request { struct cqp_commands_info info; wait_queue_head_t waitq; struct list_head list; - atomic_t refcount; + refcount_t refcount; void (*callback_fcn)(struct i40iw_cqp_request*, u32); void *param; struct i40iw_cqp_compl_info compl_info; diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c index b496f30..fc48555 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_main.c +++ b/drivers/infiniband/hw/i40iw/i40iw_main.c @@ -1125,7 +1125,7 @@ static enum i40iw_status_code i40iw_alloc_local_mac_ipaddr_entry(struct i40iw_de } /* increment refcount, because we need the cqp request ret value */ - atomic_inc(&cqp_request->refcount); + refcount_inc(&cqp_request->refcount); cqp_info = &cqp_request->info; cqp_info->cqp_cmd = OP_ALLOC_LOCAL_MAC_IPADDR_ENTRY; diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c index 9ff825f..32ff432b 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_utils.c +++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c @@ -384,10 +384,10 @@ struct i40iw_cqp_request *i40iw_get_cqp_request(struct i40iw_cqp *cqp, bool wait } if (wait) { - atomic_set(&cqp_request->refcount, 2); + refcount_set(&cqp_request->refcount, 2); cqp_request->waiting = true; } else { - atomic_set(&cqp_request->refcount, 1); + refcount_set(&cqp_request->refcount, 1); } return cqp_request; } @@ -424,7 +424,7 @@ void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp void i40iw_put_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp_request) { - if (atomic_dec_and_test(&cqp_request->refcount)) + if (refcount_dec_and_test(&cqp_request->refcount)) i40iw_free_cqp_request(cqp, cqp_request); } @@ -445,7 +445,7 @@ static void i40iw_free_pending_cqp_request(struct i40iw_cqp *cqp, } i40iw_put_cqp_request(cqp, cqp_request); wait_event_timeout(iwdev->close_wq, - !atomic_read(&cqp_request->refcount), + !refcount_read(&cqp_request->refcount), 1000); } @@ -1005,7 +1005,7 @@ static void i40iw_cqp_manage_hmc_fcn_callback(struct i40iw_cqp_request *cqp_requ if (hmcfcninfo && hmcfcninfo->callback_fcn) { i40iw_debug(&iwdev->sc_dev, I40IW_DEBUG_HMC, "%s1\n", __func__); - atomic_inc(&cqp_request->refcount); + refcount_inc(&cqp_request->refcount); work = &iwdev->virtchnl_w[hmcfcninfo->iw_vf_idx]; work->cqp_request = cqp_request; INIT_WORK(&work->work, i40iw_cqp_manage_hmc_fcn_worker);
The refcount_t API will WARN on underflow and overflow of a reference counter, and avoid use-after-free risks. Cc: Faisal Latif <faisal.latif@intel.com> Cc: Shiraz Saleem <shiraz.saleem@intel.com> Signed-off-by: Weihang Li <liweihang@huawei.com> --- drivers/infiniband/hw/i40iw/i40iw.h | 2 +- drivers/infiniband/hw/i40iw/i40iw_main.c | 2 +- drivers/infiniband/hw/i40iw/i40iw_utils.c | 10 +++++----- 3 files changed, 7 insertions(+), 7 deletions(-)