fs, nfsd: convert nfs4_file.fi_ref from atomic_t to refcount_t (818a34eb) · Commits · 戴 / test

atomic_t variables are currently used to implement reference counters with the following properties: - counter is initialized to 1 using atomic_set() - a resource is freed upon counter reaching zero - once counter reaches zero, its further increments aren't allowed - counter schema uses basic atomic operations (set, inc, inc_not_zero, dec_and_test, etc.) Such atomic variables should be converted to a newly provided refcount_t type and API that prevents accidental counter overflows and underflows. This is important since overflows and underflows can lead to use-after-free situation and be exploitable. The variable nfs4_file.fi_ref is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by:

Kees Cook <keescook@chromium.org> Reviewed-by:

David Windsor <dwindsor@gmail.com> Reviewed-by:

Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by:

Elena Reshetova <elena.reshetova@intel.com> Signed-off-by:

J. Bruce Fields <bfields@redhat.com>

fs/nfsd/nfs4state.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -359,7 +359,7 @@ put_nfs4_file(struct nfs4_file *fi)
		{
		might_lock(&state_lock);

		if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
		if (refcount_dec_and_lock(&fi->fi_ref, &state_lock)) {
		hlist_del_rcu(&fi->fi_hash);
		spin_unlock(&state_lock);
		WARN_ON_ONCE(!list_empty(&fi->fi_clnt_odstate));
		@@ -3401,7 +3401,7 @@ static void nfsd4_init_file(struct knfsd_fh *fh, unsigned int hashval,
		{
		lockdep_assert_held(&state_lock);

		atomic_set(&fp->fi_ref, 1);
		refcount_set(&fp->fi_ref, 1);
		spin_lock_init(&fp->fi_lock);
		INIT_LIST_HEAD(&fp->fi_stateids);
		INIT_LIST_HEAD(&fp->fi_delegations);
		@@ -3697,7 +3697,7 @@ find_file_locked(struct knfsd_fh *fh, unsigned int hashval)

		hlist_for_each_entry_rcu(fp, &file_hashtbl[hashval], fi_hash) {
		if (fh_match(&fp->fi_fhandle, fh)) {
		if (atomic_inc_not_zero(&fp->fi_ref))
		if (refcount_inc_not_zero(&fp->fi_ref))
		return fp;
		}
		}

fs/nfsd/state.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -484,7 +484,7 @@ struct nfs4_clnt_odstate {
		* the global state_lock spinlock.
		*/
		struct nfs4_file {
		atomic_t fi_ref;
		refcount_t fi_ref;
		spinlock_t fi_lock;
		struct hlist_node fi_hash; /* hash on fi_fhandle */
		struct list_head fi_stateids;
		@@ -637,7 +637,7 @@ struct nfs4_file find_file(struct knfsd_fh fh);
		void put_nfs4_file(struct nfs4_file *fi);
		static inline void get_nfs4_file(struct nfs4_file *fi)
		{
		atomic_inc(&fi->fi_ref);
		refcount_inc(&fi->fi_ref);
		}
		struct file find_any_file(struct nfs4_file f);

Admin message