Commit cdf5976f authored by Elena Reshetova's avatar Elena Reshetova Committed by David S. Miller

sparc64: convert mdesc_handle.refcnt from atomic_t to refcount_t

atomic_t variables are currently used to implement reference
counters with the following properties:
 - counter is initialized to 1 using atomic_set()
 - a resource is freed upon counter reaching zero
 - once counter reaches zero, its further
   increments aren't allowed
 - counter schema uses basic atomic operations
   (set, inc, inc_not_zero, dec_and_test, etc.)

Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.

The variable mdesc_handle.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarDavid Windsor <dwindsor@gmail.com>
Reviewed-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Acked-by: default avatarShannon Nelson <shannon.nelson@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 68fa10dc
...@@ -12,6 +12,7 @@ ...@@ -12,6 +12,7 @@
#include <linux/miscdevice.h> #include <linux/miscdevice.h>
#include <linux/bootmem.h> #include <linux/bootmem.h>
#include <linux/export.h> #include <linux/export.h>
#include <linux/refcount.h>
#include <asm/cpudata.h> #include <asm/cpudata.h>
#include <asm/hypervisor.h> #include <asm/hypervisor.h>
...@@ -70,7 +71,7 @@ struct mdesc_handle { ...@@ -70,7 +71,7 @@ struct mdesc_handle {
struct list_head list; struct list_head list;
struct mdesc_mem_ops *mops; struct mdesc_mem_ops *mops;
void *self_base; void *self_base;
atomic_t refcnt; refcount_t refcnt;
unsigned int handle_size; unsigned int handle_size;
struct mdesc_hdr mdesc; struct mdesc_hdr mdesc;
}; };
...@@ -152,7 +153,7 @@ static void mdesc_handle_init(struct mdesc_handle *hp, ...@@ -152,7 +153,7 @@ static void mdesc_handle_init(struct mdesc_handle *hp,
memset(hp, 0, handle_size); memset(hp, 0, handle_size);
INIT_LIST_HEAD(&hp->list); INIT_LIST_HEAD(&hp->list);
hp->self_base = base; hp->self_base = base;
atomic_set(&hp->refcnt, 1); refcount_set(&hp->refcnt, 1);
hp->handle_size = handle_size; hp->handle_size = handle_size;
} }
...@@ -182,7 +183,7 @@ static void __init mdesc_memblock_free(struct mdesc_handle *hp) ...@@ -182,7 +183,7 @@ static void __init mdesc_memblock_free(struct mdesc_handle *hp)
unsigned int alloc_size; unsigned int alloc_size;
unsigned long start; unsigned long start;
BUG_ON(atomic_read(&hp->refcnt) != 0); BUG_ON(refcount_read(&hp->refcnt) != 0);
BUG_ON(!list_empty(&hp->list)); BUG_ON(!list_empty(&hp->list));
alloc_size = PAGE_ALIGN(hp->handle_size); alloc_size = PAGE_ALIGN(hp->handle_size);
...@@ -220,7 +221,7 @@ static struct mdesc_handle *mdesc_kmalloc(unsigned int mdesc_size) ...@@ -220,7 +221,7 @@ static struct mdesc_handle *mdesc_kmalloc(unsigned int mdesc_size)
static void mdesc_kfree(struct mdesc_handle *hp) static void mdesc_kfree(struct mdesc_handle *hp)
{ {
BUG_ON(atomic_read(&hp->refcnt) != 0); BUG_ON(refcount_read(&hp->refcnt) != 0);
BUG_ON(!list_empty(&hp->list)); BUG_ON(!list_empty(&hp->list));
kfree(hp->self_base); kfree(hp->self_base);
...@@ -259,7 +260,7 @@ struct mdesc_handle *mdesc_grab(void) ...@@ -259,7 +260,7 @@ struct mdesc_handle *mdesc_grab(void)
spin_lock_irqsave(&mdesc_lock, flags); spin_lock_irqsave(&mdesc_lock, flags);
hp = cur_mdesc; hp = cur_mdesc;
if (hp) if (hp)
atomic_inc(&hp->refcnt); refcount_inc(&hp->refcnt);
spin_unlock_irqrestore(&mdesc_lock, flags); spin_unlock_irqrestore(&mdesc_lock, flags);
return hp; return hp;
...@@ -271,7 +272,7 @@ void mdesc_release(struct mdesc_handle *hp) ...@@ -271,7 +272,7 @@ void mdesc_release(struct mdesc_handle *hp)
unsigned long flags; unsigned long flags;
spin_lock_irqsave(&mdesc_lock, flags); spin_lock_irqsave(&mdesc_lock, flags);
if (atomic_dec_and_test(&hp->refcnt)) { if (refcount_dec_and_test(&hp->refcnt)) {
list_del_init(&hp->list); list_del_init(&hp->list);
hp->mops->free(hp); hp->mops->free(hp);
} }
...@@ -513,7 +514,7 @@ void mdesc_update(void) ...@@ -513,7 +514,7 @@ void mdesc_update(void)
if (status != HV_EOK || real_len > len) { if (status != HV_EOK || real_len > len) {
printk(KERN_ERR "MD: mdesc reread fails with %lu\n", printk(KERN_ERR "MD: mdesc reread fails with %lu\n",
status); status);
atomic_dec(&hp->refcnt); refcount_dec(&hp->refcnt);
mdesc_free(hp); mdesc_free(hp);
goto out; goto out;
} }
...@@ -526,7 +527,7 @@ void mdesc_update(void) ...@@ -526,7 +527,7 @@ void mdesc_update(void)
mdesc_notify_clients(orig_hp, hp); mdesc_notify_clients(orig_hp, hp);
spin_lock_irqsave(&mdesc_lock, flags); spin_lock_irqsave(&mdesc_lock, flags);
if (atomic_dec_and_test(&orig_hp->refcnt)) if (refcount_dec_and_test(&orig_hp->refcnt))
mdesc_free(orig_hp); mdesc_free(orig_hp);
else else
list_add(&orig_hp->list, &mdesc_zombie_list); list_add(&orig_hp->list, &mdesc_zombie_list);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment