linux-kernel - Re: [PATCH] sparc64: convert mdesc_handle.refcnt from atomic_t to refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2331cc3d-7a89-a835-bfc2-cab1dd2df9c3@oracle.com>
Date:   Mon, 23 Oct 2017 08:19:20 -0700
From:   Shannon Nelson <shannon.nelson@...cle.com>
To:     "Reshetova, Elena" <elena.reshetova@...el.com>,
        "davem@...emloft.net" <davem@...emloft.net>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "sparclinux@...r.kernel.org" <sparclinux@...r.kernel.org>,
        "jag.raman@...cle.com" <jag.raman@...cle.com>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "keescook@...omium.org" <keescook@...omium.org>
Subject: Re: [PATCH] sparc64: convert mdesc_handle.refcnt from atomic_t to
 refcount_t

On 10/23/2017 12:10 AM, Reshetova, Elena wrote:
>> On 10/20/2017 12:57 AM, Elena Reshetova wrote:
>>> atomic_t variables are currently used to implement reference
>>> counters with the following properties:
>>>    - counter is initialized to 1 using atomic_set()
>>>    - a resource is freed upon counter reaching zero
>>>    - once counter reaches zero, its further
>>>      increments aren't allowed
>>>    - counter schema uses basic atomic operations
>>>      (set, inc, inc_not_zero, dec_and_test, etc.)
>>>
>>> Such atomic variables should be converted to a newly provided
>>> refcount_t type and API that prevents accidental counter overflows
>>> and underflows. This is important since overflows and underflows
>>> can lead to use-after-free situation and be exploitable.
>>>
>>> The variable mdesc_handle.refcnt is used as pure reference counter.
>>> Convert it to refcount_t and fix up the operations.
>>>
>>> Suggested-by: Kees Cook <keescook@...omium.org>
>>> Reviewed-by: David Windsor <dwindsor@...il.com>
>>> Reviewed-by: Hans Liljestrand <ishkamiel@...il.com>
>>> Signed-off-by: Elena Reshetova <elena.reshetova@...el.com>
>>
>> Acked-by: Shannon Nelson <shannon.nelson@...cle.com>
> 
> Thank you Shannon! Would you be able to take this patch into the respective tree
> to propagate normally from there?
> 
> Best Regards,
> Elena.

Hi Elena,

Dave Miller takes good care of the sparclinux tree, I'm sure this is on 
his ToDo list already.

sln