| Message ID | 1489752646-8749-5-git-send-email-elena.reshetova@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, Mar 17, 2017 at 1:10 PM, Elena Reshetova <elena.reshetova@intel.com> wrote: > refcount_t type and corresponding API should be > used instead of atomic_t when the variable is used as > a reference counter. This allows to avoid accidental > refcounter overflows that might lead to use-after-free > situations. > > Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> > Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> > Signed-off-by: Kees Cook <keescook@chromium.org> > Signed-off-by: David Windsor <dwindsor@gmail.com> > --- > include/linux/ceph/libceph.h | 3 ++- > net/ceph/snapshot.c | 6 +++--- > 2 files changed, 5 insertions(+), 4 deletions(-) > > diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h > index 1816c5e..26dc674 100644 > --- a/include/linux/ceph/libceph.h > +++ b/include/linux/ceph/libceph.h > @@ -14,6 +14,7 @@ > #include <linux/wait.h> > #include <linux/writeback.h> > #include <linux/slab.h> > +#include <linux/refcount.h> > > #include <linux/ceph/types.h> > #include <linux/ceph/messenger.h> > @@ -159,7 +160,7 @@ struct ceph_client { > * dirtied. > */ > struct ceph_snap_context { > - atomic_t nref; > + refcount_t nref; > u64 seq; > u32 num_snaps; > u64 snaps[]; > diff --git a/net/ceph/snapshot.c b/net/ceph/snapshot.c > index 705414e..e14a5d0 100644 > --- a/net/ceph/snapshot.c > +++ b/net/ceph/snapshot.c > @@ -49,7 +49,7 @@ struct ceph_snap_context *ceph_create_snap_context(u32 snap_count, > if (!snapc) > return NULL; > > - atomic_set(&snapc->nref, 1); > + refcount_set(&snapc->nref, 1); > snapc->num_snaps = snap_count; > > return snapc; > @@ -59,7 +59,7 @@ EXPORT_SYMBOL(ceph_create_snap_context); > struct ceph_snap_context *ceph_get_snap_context(struct ceph_snap_context *sc) > { > if (sc) > - atomic_inc(&sc->nref); > + refcount_inc(&sc->nref); > return sc; > } > EXPORT_SYMBOL(ceph_get_snap_context); > @@ -68,7 +68,7 @@ void ceph_put_snap_context(struct ceph_snap_context *sc) > { > if (!sc) > return; > - if (atomic_dec_and_test(&sc->nref)) { > + if (refcount_dec_and_test(&sc->nref)) { > /*printk(" deleting snap_context %p\n", sc);*/ > kfree(sc); > } Applied. Thanks, Ilya -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h index 1816c5e..26dc674 100644 --- a/include/linux/ceph/libceph.h +++ b/include/linux/ceph/libceph.h @@ -14,6 +14,7 @@ #include <linux/wait.h> #include <linux/writeback.h> #include <linux/slab.h> +#include <linux/refcount.h> #include <linux/ceph/types.h> #include <linux/ceph/messenger.h> @@ -159,7 +160,7 @@ struct ceph_client { * dirtied. */ struct ceph_snap_context { - atomic_t nref; + refcount_t nref; u64 seq; u32 num_snaps; u64 snaps[]; diff --git a/net/ceph/snapshot.c b/net/ceph/snapshot.c index 705414e..e14a5d0 100644 --- a/net/ceph/snapshot.c +++ b/net/ceph/snapshot.c @@ -49,7 +49,7 @@ struct ceph_snap_context *ceph_create_snap_context(u32 snap_count, if (!snapc) return NULL; - atomic_set(&snapc->nref, 1); + refcount_set(&snapc->nref, 1); snapc->num_snaps = snap_count; return snapc; @@ -59,7 +59,7 @@ EXPORT_SYMBOL(ceph_create_snap_context); struct ceph_snap_context *ceph_get_snap_context(struct ceph_snap_context *sc) { if (sc) - atomic_inc(&sc->nref); + refcount_inc(&sc->nref); return sc; } EXPORT_SYMBOL(ceph_get_snap_context); @@ -68,7 +68,7 @@ void ceph_put_snap_context(struct ceph_snap_context *sc) { if (!sc) return; - if (atomic_dec_and_test(&sc->nref)) { + if (refcount_dec_and_test(&sc->nref)) { /*printk(" deleting snap_context %p\n", sc);*/ kfree(sc); }