linux-kernel - Re: [PATCH] ext4: Convert from atomic_t to refcount_t on ext4_io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210804140604.GF4578@quack2.suse.cz>
Date:   Wed, 4 Aug 2021 16:06:04 +0200
From:   Jan Kara <jack@...e.cz>
To:     Xiyu Yang <xiyuyang19@...an.edu.cn>
Cc:     Theodore Ts'o <tytso@....edu>,
        Andreas Dilger <adilger.kernel@...ger.ca>,
        linux-ext4@...r.kernel.org, linux-kernel@...r.kernel.org,
        yuanxzhang@...an.edu.cn, Xin Tan <tanxin.ctf@...il.com>
Subject: Re: [PATCH] ext4: Convert from atomic_t to refcount_t on
 ext4_io_end->count

On Mon 19-07-21 13:59:14, Xiyu Yang wrote:
> refcount_t type and corresponding API can protect refcounters from
> accidental underflow and overflow and further use-after-free situations.
> 
> Signed-off-by: Xiyu Yang <xiyuyang19@...an.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@...il.com>

Looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@...e.cz>

								Honza

> ---
>  fs/ext4/ext4.h    | 3 ++-
>  fs/ext4/page-io.c | 8 ++++----
>  2 files changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
> index 3c51e243450d..e5b3575da7e9 100644
> --- a/fs/ext4/ext4.h
> +++ b/fs/ext4/ext4.h
> @@ -17,6 +17,7 @@
>  #ifndef _EXT4_H
>  #define _EXT4_H
>  
> +#include <linux/refcount.h>
>  #include <linux/types.h>
>  #include <linux/blkdev.h>
>  #include <linux/magic.h>
> @@ -241,7 +242,7 @@ typedef struct ext4_io_end {
>  	struct bio		*bio;		/* Linked list of completed
>  						 * bios covering the extent */
>  	unsigned int		flag;		/* unwritten or not */
> -	atomic_t		count;		/* reference counter */
> +	refcount_t		count;		/* reference counter */
>  	struct list_head	list_vec;	/* list of ext4_io_end_vec */
>  } ext4_io_end_t;
>  
> diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
> index f038d578d8d8..9cb261714991 100644
> --- a/fs/ext4/page-io.c
> +++ b/fs/ext4/page-io.c
> @@ -279,14 +279,14 @@ ext4_io_end_t *ext4_init_io_end(struct inode *inode, gfp_t flags)
>  		io_end->inode = inode;
>  		INIT_LIST_HEAD(&io_end->list);
>  		INIT_LIST_HEAD(&io_end->list_vec);
> -		atomic_set(&io_end->count, 1);
> +		refcount_set(&io_end->count, 1);
>  	}
>  	return io_end;
>  }
>  
>  void ext4_put_io_end_defer(ext4_io_end_t *io_end)
>  {
> -	if (atomic_dec_and_test(&io_end->count)) {
> +	if (refcount_dec_and_test(&io_end->count)) {
>  		if (!(io_end->flag & EXT4_IO_END_UNWRITTEN) ||
>  				list_empty(&io_end->list_vec)) {
>  			ext4_release_io_end(io_end);
> @@ -300,7 +300,7 @@ int ext4_put_io_end(ext4_io_end_t *io_end)
>  {
>  	int err = 0;
>  
> -	if (atomic_dec_and_test(&io_end->count)) {
> +	if (refcount_dec_and_test(&io_end->count)) {
>  		if (io_end->flag & EXT4_IO_END_UNWRITTEN) {
>  			err = ext4_convert_unwritten_io_end_vec(io_end->handle,
>  								io_end);
> @@ -314,7 +314,7 @@ int ext4_put_io_end(ext4_io_end_t *io_end)
>  
>  ext4_io_end_t *ext4_get_io_end(ext4_io_end_t *io_end)
>  {
> -	atomic_inc(&io_end->count);
> +	refcount_inc(&io_end->count);
>  	return io_end;
>  }
>  
> -- 
> 2.7.4
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR