Re: [PATCH v7 11/17] refcount: introduce __refcount_{add|inc}_not_zero_limited

On Fri, Jan 10, 2025 at 5:32 AM David Laight
[off-list ref] wrote:

On Wed, 8 Jan 2025 15:06:17 +0000
Matthew Wilcox [off-list ref] wrote:

quoted

On Wed, Jan 08, 2025 at 10:16:04AM +0100, Vlastimil Babka wrote:

quoted

quoted

 static inline __must_check __signed_wrap
-bool __refcount_add_not_zero(int i, refcount_t *r, int *oldp)
+bool __refcount_add_not_zero_limited(int i, refcount_t *r, int *oldp,
+                              int limit)
 {
  int old = refcount_read(r);

  do {
          if (!old)
                  break;
+         if (limit && old + i > limit) {

Should this be e.g. "old > limit - i" to avoid overflow and false negative
if someone sets limit close to INT_MAX?

Although 'i' might also be INT_MAX, whereas we know that old < limit.
So "i > limit - old" is the correct condition to check, IMO.

I'd further suggest that using a limit of 0 to mean "unlimited" introduces
an unnecessary arithmetic operation.  Make 'limit' inclusive instead
of exclusive, pass INT_MAX instead of 0, and Vlastimil's suggestion,
and this becomes:

              if (i > limit - old)

...

The problem with that is the compiler is unlikely to optimise it away.
Perhaps:
                if (statically_true(!limit || limit == INT_MAX))
                        continue;
                if (i > limit - old) {
                        ...

Thanks for the comment! I think it makes sense.
For the reference, the new version of this patch is here:
https://lore.kernel.org/all/20250109023025.2242447-11-surenb@google.com/ (local)
If I apply your suggestion to that version it should look like this:

+bool __refcount_add_not_zero_limited(int i, refcount_t *r, int *oldp,
+                                     int limit)
 {
        int old = refcount_read(r);

        do {
               if (!old)
                      break;
+
+                if (statically_true(limit == INT_MAX))
+                        continue;
+
+                if (i > limit - old) {
+                        if (oldp)
+                                *oldp = old;
+                        return false;
+                }
        } while (!atomic_try_cmpxchg_relaxed(&r->refs, &old, old + i));

I'll update the patch with this and let's see if everyone agrees.

        David