[PATCH 01/29] drivers, block: convert xen_blkif.refcnt from atomic_t to refcount_t
From: Elena Reshetova <elena.reshetova@intel.com>
Date: 2017-03-06 14:35:32
Also in:
linux-bcache, linux-media, linux-pci, linux-raid, linux-s390, linux-scsi, linux-serial, lkml
Subsystem:
block layer, the rest, xen block subsystem · Maintainers:
Jens Axboe, Linus Torvalds, Roger Pau Monné
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <redacted> Signed-off-by: Kees Cook <redacted> Signed-off-by: David Windsor <redacted> --- drivers/block/xen-blkback/common.h | 7 ++++--- drivers/block/xen-blkback/xenbus.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index dea61f6..2ccfd62 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h@@ -35,6 +35,7 @@ #include <linux/wait.h> #include <linux/io.h> #include <linux/rbtree.h> +#include <linux/refcount.h> #include <asm/setup.h> #include <asm/pgalloc.h> #include <asm/hypervisor.h>
@@ -333,7 +334,7 @@ struct xen_blkif { struct xen_vbd vbd; /* Back pointer to the backend_info. */ struct backend_info *be; - atomic_t refcnt; + refcount_t refcnt; /* for barrier (drain) requests */ struct completion drain_complete; atomic_t drain;
@@ -386,10 +387,10 @@ struct pending_req { (_v)->bdev->bd_part->nr_sects : \ get_capacity((_v)->bdev->bd_disk)) -#define xen_blkif_get(_b) (atomic_inc(&(_b)->refcnt)) +#define xen_blkif_get(_b) (refcount_inc(&(_b)->refcnt)) #define xen_blkif_put(_b) \ do { \ - if (atomic_dec_and_test(&(_b)->refcnt)) \ + if (refcount_dec_and_test(&(_b)->refcnt)) \ schedule_work(&(_b)->free_work);\ } while (0)
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 8fe61b5..9f89be3 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c@@ -176,7 +176,7 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid) return ERR_PTR(-ENOMEM); blkif->domid = domid; - atomic_set(&blkif->refcnt, 1); + refcount_set(&blkif->refcnt, 1); init_completion(&blkif->drain_complete); INIT_WORK(&blkif->free_work, xen_blkif_deferred_free);
--
2.7.4