| Message ID | 1621590825-60693-15-git-send-email-liweihang@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | RDMA: Use refcount_t for reference counting | expand |
On Fri, May 21, 2021 at 7:35 PM Weihang Li <liweihang@huawei.com> wrote: > > The refcount_t API will WARN on underflow and overflow of a reference > counter, and avoid use-after-free risks. > > Cc: Faisal Latif <faisal.latif@intel.com> > Cc: Shiraz Saleem <shiraz.saleem@intel.com> > Signed-off-by: Weihang Li <liweihang@huawei.com> > --- > drivers/infiniband/hw/i40iw/i40iw_cm.c | 8 ++++---- > drivers/infiniband/hw/i40iw/i40iw_puda.h | 2 +- https://patchwork.kernel.org/project/linux-rdma/patch/20210520143809.819-22-shiraz.saleem@intel.com/ In this commit, i40iw will be removed. And this commit will be merged into upstream linux. Zhu Yanjun > 2 files changed, 5 insertions(+), 5 deletions(-) > > diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c > index c1becb9..9bb86a4 100644 > --- a/drivers/infiniband/hw/i40iw/i40iw_cm.c > +++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c > @@ -77,7 +77,7 @@ void i40iw_free_sqbuf(struct i40iw_sc_vsi *vsi, void *bufp) > struct i40iw_puda_buf *buf = (struct i40iw_puda_buf *)bufp; > struct i40iw_puda_rsrc *ilq = vsi->ilq; > > - if (!atomic_dec_return(&buf->refcount)) > + if (refcount_dec_and_test(&buf->refcount)) > i40iw_puda_ret_bufpool(ilq, buf); > } > > @@ -531,7 +531,7 @@ static struct i40iw_puda_buf *i40iw_form_cm_frame(struct i40iw_cm_node *cm_node, > if (pdata && pdata->addr) > memcpy(buf, pdata->addr, pdata->size); > > - atomic_set(&sqbuf->refcount, 1); > + refcount_set(&sqbuf->refcount, 1); > > return sqbuf; > } > @@ -1096,7 +1096,7 @@ int i40iw_schedule_cm_timer(struct i40iw_cm_node *cm_node, > spin_unlock_irqrestore(&cm_node->retrans_list_lock, flags); > new_send->timetosend = jiffies + I40IW_RETRY_TIMEOUT; > > - atomic_inc(&sqbuf->refcount); > + refcount_inc(&sqbuf->refcount); > i40iw_puda_send_buf(vsi->ilq, sqbuf); > if (!send_retrans) { > i40iw_cleanup_retrans_entry(cm_node); > @@ -1286,7 +1286,7 @@ static void i40iw_cm_timer_tick(struct timer_list *t) > vsi = &cm_node->iwdev->vsi; > > if (!cm_node->ack_rcvd) { > - atomic_inc(&send_entry->sqbuf->refcount); > + refcount_inc(&send_entry->sqbuf->refcount); > i40iw_puda_send_buf(vsi->ilq, send_entry->sqbuf); > cm_node->cm_core->stats_pkt_retrans++; > } > diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.h b/drivers/infiniband/hw/i40iw/i40iw_puda.h > index 53a7d58..5996626 100644 > --- a/drivers/infiniband/hw/i40iw/i40iw_puda.h > +++ b/drivers/infiniband/hw/i40iw/i40iw_puda.h > @@ -90,7 +90,7 @@ struct i40iw_puda_buf { > u8 tcphlen; /* tcp length in bytes */ > u8 maclen; /* mac length in bytes */ > u32 totallen; /* machlen+iphlen+tcphlen+datalen */ > - atomic_t refcount; > + refcount_t refcount; > u8 hdrlen; > bool ipv4; > u32 seqnum; > -- > 2.7.4 >
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c index c1becb9..9bb86a4 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_cm.c +++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c @@ -77,7 +77,7 @@ void i40iw_free_sqbuf(struct i40iw_sc_vsi *vsi, void *bufp) struct i40iw_puda_buf *buf = (struct i40iw_puda_buf *)bufp; struct i40iw_puda_rsrc *ilq = vsi->ilq; - if (!atomic_dec_return(&buf->refcount)) + if (refcount_dec_and_test(&buf->refcount)) i40iw_puda_ret_bufpool(ilq, buf); } @@ -531,7 +531,7 @@ static struct i40iw_puda_buf *i40iw_form_cm_frame(struct i40iw_cm_node *cm_node, if (pdata && pdata->addr) memcpy(buf, pdata->addr, pdata->size); - atomic_set(&sqbuf->refcount, 1); + refcount_set(&sqbuf->refcount, 1); return sqbuf; } @@ -1096,7 +1096,7 @@ int i40iw_schedule_cm_timer(struct i40iw_cm_node *cm_node, spin_unlock_irqrestore(&cm_node->retrans_list_lock, flags); new_send->timetosend = jiffies + I40IW_RETRY_TIMEOUT; - atomic_inc(&sqbuf->refcount); + refcount_inc(&sqbuf->refcount); i40iw_puda_send_buf(vsi->ilq, sqbuf); if (!send_retrans) { i40iw_cleanup_retrans_entry(cm_node); @@ -1286,7 +1286,7 @@ static void i40iw_cm_timer_tick(struct timer_list *t) vsi = &cm_node->iwdev->vsi; if (!cm_node->ack_rcvd) { - atomic_inc(&send_entry->sqbuf->refcount); + refcount_inc(&send_entry->sqbuf->refcount); i40iw_puda_send_buf(vsi->ilq, send_entry->sqbuf); cm_node->cm_core->stats_pkt_retrans++; } diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.h b/drivers/infiniband/hw/i40iw/i40iw_puda.h index 53a7d58..5996626 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_puda.h +++ b/drivers/infiniband/hw/i40iw/i40iw_puda.h @@ -90,7 +90,7 @@ struct i40iw_puda_buf { u8 tcphlen; /* tcp length in bytes */ u8 maclen; /* mac length in bytes */ u32 totallen; /* machlen+iphlen+tcphlen+datalen */ - atomic_t refcount; + refcount_t refcount; u8 hdrlen; bool ipv4; u32 seqnum;
The refcount_t API will WARN on underflow and overflow of a reference counter, and avoid use-after-free risks. Cc: Faisal Latif <faisal.latif@intel.com> Cc: Shiraz Saleem <shiraz.saleem@intel.com> Signed-off-by: Weihang Li <liweihang@huawei.com> --- drivers/infiniband/hw/i40iw/i40iw_cm.c | 8 ++++---- drivers/infiniband/hw/i40iw/i40iw_puda.h | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-)