From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:24:00
Note: these are the last patches related to networking that perform
conversion of refcounters from atomic_t to refcount_t.
In contrast to the core network refcounter conversions that
were merged earlier, these are much more straightforward ones.
This series, for various networking drivers, replaces atomic_t reference
counters with the new refcount_t type and API (see include/linux/refcount.h).
By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.
The patches are fully independent and can be cherry-picked separately.
Patches are based on top of net-next.
If there are no objections to the patches, please merge them via respective trees
Elena Reshetova (15):
drivers, net, ethernet: convert clip_entry.refcnt from atomic_t to
refcount_t
drivers, net, ethernet: convert mtk_eth.dma_refcnt from atomic_t to
refcount_t
drivers, net, mlx4: convert mlx4_cq.refcount from atomic_t to
refcount_t
drivers, net, mlx4: convert mlx4_qp.refcount from atomic_t to
refcount_t
drivers, net, mlx4: convert mlx4_srq.refcount from atomic_t to
refcount_t
drivers, net, mlx5: convert mlx5_cq.refcount from atomic_t to
refcount_t
drivers, net, mlx5: convert fs_node.refcount from atomic_t to
refcount_t
drivers, net, hamradio: convert sixpack.refcnt from atomic_t to
refcount_t
drivers, net: convert masces_rx_sa.refcnt from atomic_t to refcount_t
drivers, net: convert masces_rx_sc.refcnt from atomic_t to refcount_t
drivers, net: convert masces_tx_sa.refcnt from atomic_t to refcount_t
drivers, net, ppp: convert asyncppp.refcnt from atomic_t to refcount_t
drivers, net, ppp: convert ppp_file.refcnt from atomic_t to refcount_t
drivers, net, ppp: convert syncppp.refcnt from atomic_t to refcount_t
drivers, connector: convert cn_callback_entry.refcnt from atomic_t to
refcount_t
drivers/connector/cn_queue.c | 4 ++--
drivers/connector/connector.c | 2 +-
drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c | 13 +++++------
drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h | 4 +++-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 ++++---
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 +++-
drivers/net/ethernet/mellanox/mlx4/cq.c | 8 +++----
drivers/net/ethernet/mellanox/mlx4/qp.c | 8 +++----
drivers/net/ethernet/mellanox/mlx4/srq.c | 8 +++----
drivers/net/ethernet/mellanox/mlx5/core/cq.c | 16 ++++++-------
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 28 +++++++++++------------
drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 3 ++-
drivers/net/hamradio/6pack.c | 12 +++++-----
drivers/net/macsec.c | 25 ++++++++++----------
drivers/net/ppp/ppp_async.c | 10 ++++----
drivers/net/ppp/ppp_generic.c | 21 +++++++++--------
drivers/net/ppp/ppp_synctty.c | 11 +++++----
include/linux/connector.h | 4 ++--
include/linux/mlx4/device.h | 8 +++----
include/linux/mlx5/cq.h | 4 ++--
20 files changed, 105 insertions(+), 96 deletions(-)
--
2.7.4
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:24:08
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable clip_entry.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c | 13 ++++++-------
drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h | 4 +++-
2 files changed, 9 insertions(+), 8 deletions(-)
@@ -10,9 +10,11 @@*releaseforlicensingtermsandconditions.*/+#include<linux/refcount.h>+structclip_entry{spinlock_tlock;/* Hold while modifying clip reference */-atomic_trefcnt;+refcount_trefcnt;structlist_headlist;union{structsockaddr_inaddr;
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:24:13
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mtk_eth.dma_refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 +++++---
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 +++-
2 files changed, 8 insertions(+), 4 deletions(-)
@@ -1817,7 +1817,7 @@ static int mtk_open(struct net_device *dev)structmtk_eth*eth=mac->hw;/* we run 2 netdevs on the same dma ring so we only bring it up once */-if(!atomic_read(ð->dma_refcnt)){+if(!refcount_read(ð->dma_refcnt)){interr=mtk_start_dma(eth);if(err)
@@ -1827,8 +1827,10 @@ static int mtk_open(struct net_device *dev)napi_enable(ð->rx_napi);mtk_tx_irq_enable(eth,MTK_TX_DONE_INT);mtk_rx_irq_enable(eth,MTK_RX_DONE_INT);+refcount_set(ð->dma_refcnt,1);}-atomic_inc(ð->dma_refcnt);+else+refcount_inc(ð->dma_refcnt);phy_start(dev->phydev);netif_start_queue(dev);
@@ -1868,7 +1870,7 @@ static int mtk_stop(struct net_device *dev)phy_stop(dev->phydev);/* only shutdown DMA if this is the last user */-if(!atomic_dec_and_test(ð->dma_refcnt))+if(!refcount_dec_and_test(ð->dma_refcnt))return0;mtk_tx_irq_disable(eth,MTK_TX_DONE_INT);
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:24:20
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mlx4_cq.refcount is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mellanox/mlx4/cq.c | 8 ++++----
include/linux/mlx4/device.h | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
@@ -344,7 +344,7 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,cq->cons_index=0;cq->arm_sn=1;cq->uar=uar;-atomic_set(&cq->refcount,1);+refcount_set(&cq->refcount,1);init_completion(&cq->free);cq->comp=mlx4_add_cq_to_tasklet;cq->tasklet_ctx.priv=
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:24:31
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mlx4_srq.refcount is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mellanox/mlx4/srq.c | 8 ++++----
include/linux/mlx4/device.h | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:24:37
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mlx5_cq.refcount is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mellanox/mlx5/core/cq.c | 16 ++++++++--------
include/linux/mlx5/cq.h | 4 ++--
2 files changed, 10 insertions(+), 10 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:25:15
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable masces_rx_sa.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/macsec.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:25:18
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable sixpack.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/hamradio/6pack.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
@@ -576,7 +576,7 @@ static int sixpack_open(struct tty_struct *tty)sp->dev=dev;spin_lock_init(&sp->lock);-atomic_set(&sp->refcnt,1);+refcount_set(&sp->refcnt,1);sema_init(&sp->dead_sem,0);/* !!! length of the buffers. MTU is IP MTU, not PACLEN! */
@@ -670,7 +670,7 @@ static void sixpack_close(struct tty_struct *tty)*Wehavenowensuredthatnobodycanstartusingapfromnowon,but*wehavetowaitforallexistinguserstofinish.*/-if(!atomic_dec_and_test(&sp->refcnt))+if(!refcount_dec_and_test(&sp->refcnt))down(&sp->dead_sem);/* We must stop the queue to avoid potentially scribbling
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:25:19
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable masces_tx_sa.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/macsec.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:25:36
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable ppp_file.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ppp/ppp_generic.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
@@ -84,7 +85,7 @@ struct ppp_file {structsk_buff_headxq;/* pppd transmit queue */structsk_buff_headrq;/* receive queue for pppd */wait_queue_head_trwait;/* for poll on reading /dev/ppp */-atomic_trefcnt;/* # refs (incl /dev/ppp attached) */+refcount_trefcnt;/* # refs (incl /dev/ppp attached) */inthdrlen;/* space to leave for headers */intindex;/* interface unit / channel number */intdead;/* unit/channel has been shut down */
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:25:56
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable cn_callback_entry.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/connector/cn_queue.c | 4 ++--
drivers/connector/connector.c | 2 +-
include/linux/connector.h | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:25:57
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable syncppp.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ppp/ppp_synctty.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:27:16
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable asyncppp.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ppp/ppp_async.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:28:28
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable masces_rx_sc.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/macsec.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:28:29
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable fs_node.refcount is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 28 +++++++++++------------
drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 3 ++-
2 files changed, 16 insertions(+), 15 deletions(-)
@@ -84,7 +85,7 @@ struct fs_node {structfs_node*root;/* lock the node for writing and traversing */structrw_semaphorelock;-atomic_trefcount;+refcount_trefcount;boolactive;void(*del_hw_func)(structfs_node*);void(*del_sw_func)(structfs_node*);
From: Elena Reshetova <elena.reshetova@intel.com> Date: 2017-10-20 07:31:20
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mlx4_qp.refcount is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <redacted>
---
drivers/net/ethernet/mellanox/mlx4/qp.c | 8 ++++----
include/linux/mlx4/device.h | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
From: Sean Wang <sean.wang@mediatek.com> Date: 2017-10-20 08:09:14
On Fri, 2017-10-20 at 10:23 +0300, Elena Reshetova wrote:
quoted hunk
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mtk_eth.dma_refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <redacted>
---
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 +++++---
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 +++-
2 files changed, 8 insertions(+), 4 deletions(-)
@@ -1817,7 +1817,7 @@ static int mtk_open(struct net_device *dev)structmtk_eth*eth=mac->hw;/* we run 2 netdevs on the same dma ring so we only bring it up once */-if(!atomic_read(ð->dma_refcnt)){+if(!refcount_read(ð->dma_refcnt)){interr=mtk_start_dma(eth);if(err)
@@ -1827,8 +1827,10 @@ static int mtk_open(struct net_device *dev)napi_enable(ð->rx_napi);mtk_tx_irq_enable(eth,MTK_TX_DONE_INT);mtk_rx_irq_enable(eth,MTK_RX_DONE_INT);+refcount_set(ð->dma_refcnt,1);
the existing driver seems to have a missing initial atomic_set for the
eth->dma_refcnt.
how about add the initial refcount_set into probe handler, and keep
logic else unchanged ?
quoted hunk
phy_start(dev->phydev);
netif_start_queue(dev);
@@ -1868,7 +1870,7 @@ static int mtk_stop(struct net_device *dev) phy_stop(dev->phydev); /* only shutdown DMA if this is the last user */- if (!atomic_dec_and_test(ð->dma_refcnt))+ if (!refcount_dec_and_test(ð->dma_refcnt)) return 0; mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
On Fri, 2017-10-20 at 10:23 +0300, Elena Reshetova wrote:
quoted
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mtk_eth.dma_refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 +++++---
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 +++-
2 files changed, 8 insertions(+), 4 deletions(-)
@@ -1817,7 +1817,7 @@ static int mtk_open(struct net_device *dev)structmtk_eth*eth=mac->hw;/* we run 2 netdevs on the same dma ring so we only bring it up once
*/
quoted
- if (!atomic_read(ð->dma_refcnt)) {
+ if (!refcount_read(ð->dma_refcnt)) {
int err = mtk_start_dma(eth);
if (err)
how about add the initial refcount_set into probe handler, and keep
logic else unchanged ?
Sure, I guess you mean mtk_probe() function? I can move the refcount_set to be there
and remove this change.
Should I resend the modified patch to you (maybe then two of the ethernet patches)?
Best Regards,
Elena.
quoted
phy_start(dev->phydev);
netif_start_queue(dev);
@@ -1868,7 +1870,7 @@ static int mtk_stop(struct net_device *dev) phy_stop(dev->phydev); /* only shutdown DMA if this is the last user */- if (!atomic_dec_and_test(ð->dma_refcnt))+ if (!refcount_dec_and_test(ð->dma_refcnt)) return 0; mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
From: David Miller <davem@davemloft.net> Date: 2017-10-22 01:31:43
From: Elena Reshetova <elena.reshetova@intel.com>
Date: Fri, 20 Oct 2017 10:23:34 +0300
Note: these are the last patches related to networking that perform
conversion of refcounters from atomic_t to refcount_t.
In contrast to the core network refcounter conversions that
were merged earlier, these are much more straightforward ones.
This series, for various networking drivers, replaces atomic_t reference
counters with the new refcount_t type and API (see include/linux/refcount.h).
By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.
The patches are fully independent and can be cherry-picked separately.
Patches are based on top of net-next.
If there are no objections to the patches, please merge them via respective trees
I've applied this entire series to net-next. If there are any fixups or
follow-ups please send them as relative patches.
Thank you.
From: Sean Wang <sean.wang@mediatek.com> Date: 2017-10-22 04:06:49
On Fri, 2017-10-20 at 10:37 +0000, Reshetova, Elena wrote:
quoted
On Fri, 2017-10-20 at 10:23 +0300, Elena Reshetova wrote:
quoted
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mtk_eth.dma_refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 +++++---
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 +++-
2 files changed, 8 insertions(+), 4 deletions(-)
@@ -1817,7 +1817,7 @@ static int mtk_open(struct net_device *dev)structmtk_eth*eth=mac->hw;/* we run 2 netdevs on the same dma ring so we only bring it up once
*/
quoted
- if (!atomic_read(ð->dma_refcnt)) {
+ if (!refcount_read(ð->dma_refcnt)) {
int err = mtk_start_dma(eth);
if (err)
how about add the initial refcount_set into probe handler, and keep
logic else unchanged ?
Sure, I guess you mean mtk_probe() function? I can move the refcount_set to be there
and remove this change.
Should I resend the modified patch to you (maybe then two of the ethernet patches)?
Best Regards,
Elena.
The entire series has been applies to net-next, I think I can make the
follow-ups patches relative to your work.
Sean
quoted
quoted
phy_start(dev->phydev);
netif_start_queue(dev);
@@ -1868,7 +1870,7 @@ static int mtk_stop(struct net_device *dev) phy_stop(dev->phydev); /* only shutdown DMA if this is the last user */- if (!atomic_dec_and_test(ð->dma_refcnt))+ if (!refcount_dec_and_test(ð->dma_refcnt)) return 0; mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
From: Elena Reshetova <elena.reshetova@intel.com>
Date: Fri, 20 Oct 2017 10:23:34 +0300
quoted
Note: these are the last patches related to networking that perform
conversion of refcounters from atomic_t to refcount_t.
In contrast to the core network refcounter conversions that
were merged earlier, these are much more straightforward ones.
This series, for various networking drivers, replaces atomic_t reference
counters with the new refcount_t type and API (see include/linux/refcount.h).
By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.
The patches are fully independent and can be cherry-picked separately.
Patches are based on top of net-next.
If there are no objections to the patches, please merge them via respective trees
I've applied this entire series to net-next. If there are any fixups or
follow-ups please send them as relative patches.
Thank you.
Thank you very much David! Will send fixups separately.
Best Regards,
Elena.
On Fri, 2017-10-20 at 10:37 +0000, Reshetova, Elena wrote:
quoted
quoted
On Fri, 2017-10-20 at 10:23 +0300, Elena Reshetova wrote:
quoted
atomic_t variables are currently used to implement reference
counters with the following properties:
- counter is initialized to 1 using atomic_set()
- a resource is freed upon counter reaching zero
- once counter reaches zero, its further
increments aren't allowed
- counter schema uses basic atomic operations
(set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.
The variable mtk_eth.dma_refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: Kees Cook <redacted>
Reviewed-by: David Windsor <redacted>
Reviewed-by: Hans Liljestrand <redacted>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
---
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 +++++---
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 +++-
2 files changed, 8 insertions(+), 4 deletions(-)
@@ -1817,7 +1817,7 @@ static int mtk_open(struct net_device *dev)structmtk_eth*eth=mac->hw;/* we run 2 netdevs on the same dma ring so we only bring it up once
*/
quoted
- if (!atomic_read(ð->dma_refcnt)) {
+ if (!refcount_read(ð->dma_refcnt)) {
int err = mtk_start_dma(eth);
if (err)
how about add the initial refcount_set into probe handler, and keep
logic else unchanged ?
Sure, I guess you mean mtk_probe() function? I can move the refcount_set to be
there
quoted
and remove this change.
Should I resend the modified patch to you (maybe then two of the ethernet
patches)?
quoted
Best Regards,
Elena.
The entire series has been applies to net-next, I think I can make the
follow-ups patches relative to your work.
Sean
Yes, I just noticed that David took them all.
Sure, if you want to send the follow up yourself, I certainly would not mind,
I still have many of these recount patches for different parts of kernel :)
Thank you!
Best Regards,
Elena.
quoted
quoted
quoted
phy_start(dev->phydev);
netif_start_queue(dev);
@@ -1868,7 +1870,7 @@ static int mtk_stop(struct net_device *dev) phy_stop(dev->phydev); /* only shutdown DMA if this is the last user */- if (!atomic_dec_and_test(ð->dma_refcnt))+ if (!refcount_dec_and_test(ð->dma_refcnt)) return 0; mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);