GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-22 14:41:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

drivers, net, mlx5: convert mlx5_cq.refcount from atomic_t to refcount_t

Browse source 
atomic_t variables are currently used to implement reference
counters with the following properties:
 - counter is initialized to 1 using atomic_set()
 - a resource is freed upon counter reaching zero
 - once counter reaches zero, its further
   increments aren't allowed
 - counter schema uses basic atomic operations
   (set, inc, inc_not_zero, dec_and_test, etc.)

Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.

The variable mlx5_cq.refcount is used as pure reference counter.
Convert it to refcount_t and fix up the operations.

Suggested-by: Kees Cook <keescook@chromium.org>
Reviewed-by: David Windsor <dwindsor@gmail.com>
Reviewed-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Elena Reshetova 2017-10-20 10:23:40 +03:00 • committed by David S. Miller
parent 17ac99b2b8
commit a4b51a9f83
2 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
include/linux/mlx5/cq.h
View file

@ -35,7 +35,7 @@
#include <rdma/ib_verbs.h>
#include <linux/mlx5/driver.h>
#include <linux/refcount.h>
struct mlx5_core_cq {
u32 cqn;
@ -43,7 +43,7 @@ struct mlx5_core_cq {
__be32 *set_ci_db;
__be32 *arm_db;
struct mlx5_uars_page *uar;
atomic_t refcount;
refcount_t refcount;
struct completion free;
unsigned vector;
unsigned int irqn;