lkml.org 
[lkml]   [2018]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 3/6] bdi: Use refcount_t for reference counting instead atomic_t
On Tue,  3 Jul 2018 22:01:38 +0200 Sebastian Andrzej Siewior <bigeasy@linutronix.de> wrote:

> refcount_t type and corresponding API should be used instead of atomic_t when
> the variable is used as a reference counter. This allows to avoid accidental
> refcounter overflows that might lead to use-after-free situations.
>
> ...
>
> --- a/mm/backing-dev.c
> +++ b/mm/backing-dev.c
> @@ -438,10 +438,10 @@ wb_congested_get_create(struct backing_dev_info *bdi, int blkcg_id, gfp_t gfp)
> if (new_congested) {
> /* !found and storage for new one already allocated, insert */
> congested = new_congested;
> - new_congested = NULL;
> rb_link_node(&congested->rb_node, parent, node);
> rb_insert_color(&congested->rb_node, &bdi->cgwb_congested_tree);
> - goto found;
> + spin_unlock_irqrestore(&cgwb_lock, flags);
> + return congested;
> }
>
> spin_unlock_irqrestore(&cgwb_lock, flags);
> @@ -451,13 +451,13 @@ wb_congested_get_create(struct backing_dev_info *bdi, int blkcg_id, gfp_t gfp)
> if (!new_congested)
> return NULL;
>
> - atomic_set(&new_congested->refcnt, 0);
> + refcount_set(&new_congested->refcnt, 1);
> new_congested->__bdi = bdi;
> new_congested->blkcg_id = blkcg_id;
> goto retry;
>
> found:
> - atomic_inc(&congested->refcnt);
> + refcount_inc(&congested->refcnt);
> spin_unlock_irqrestore(&cgwb_lock, flags);
> kfree(new_congested);
> return congested;
>
> ...
>

I'm not sure that the restructuring of wb_congested_get_create() was
desirable and it does make the patch harder to review. But it looks
OK to me.

\
 
 \ /
  Last update: 2018-07-17 00:58    [W:0.298 / U:5.972 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site