Commit 0e1a5ee6 authored by Elena Reshetova's avatar Elena Reshetova Committed by Ilya Dryomov
Browse files

libceph: convert ceph_pagelist.refcnt from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 02113a0f

fs/ceph/mds_client.c

+1 −1
Original line number Diff line number Diff line
@@ -1991,7 +1991,7 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc, 


	if (req->r_pagelist) {

		struct ceph_pagelist *pagelist = req->r_pagelist;

		atomic_inc(&pagelist->refcnt);

		refcount_inc(&pagelist->refcnt);

		ceph_msg_data_add_pagelist(msg, pagelist);

		msg->hdr.data_len = cpu_to_le32(pagelist->length);

	} else {

include/linux/ceph/pagelist.h

+3 −3
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@ 
#define __FS_CEPH_PAGELIST_H



#include <asm/byteorder.h>

#include <linux/atomic.h>

#include <linux/refcount.h>

#include <linux/list.h>

#include <linux/types.h>
@@ -13,7 +13,7 @@ struct ceph_pagelist { 
	size_t room;

	struct list_head free_list;

	size_t num_pages_free;

	atomic_t refcnt;

	refcount_t refcnt;

};



struct ceph_pagelist_cursor {
@@ -30,7 +30,7 @@ static inline void ceph_pagelist_init(struct ceph_pagelist *pl) 
	pl->room = 0;

	INIT_LIST_HEAD(&pl->free_list);

	pl->num_pages_free = 0;

	atomic_set(&pl->refcnt, 1);

	refcount_set(&pl->refcnt, 1);

}



extern void ceph_pagelist_release(struct ceph_pagelist *pl);

net/ceph/pagelist.c

+1 −1
Original line number Diff line number Diff line
@@ -16,7 +16,7 @@ static void ceph_pagelist_unmap_tail(struct ceph_pagelist *pl) 


void ceph_pagelist_release(struct ceph_pagelist *pl)

{

	if (!atomic_dec_and_test(&pl->refcnt))

	if (!refcount_dec_and_test(&pl->refcnt))

		return;

	ceph_pagelist_unmap_tail(pl);

	while (!list_empty(&pl->head)) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE