mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 00:34:52 +00:00
a2a5dea7b6
atomic_t variables are currently used to implement reference counters with the following properties: - counter is initialized to 1 using atomic_set() - a resource is freed upon counter reaching zero - once counter reaches zero, its further increments aren't allowed - counter schema uses basic atomic operations (set, inc, inc_not_zero, dec_and_test, etc.) Such atomic variables should be converted to a newly provided refcount_t type and API that prevents accidental counter overflows and underflows. This is important since overflows and underflows can lead to use-after-free situation and be exploitable. The variable nfs4_pnfs_ds.ds_count is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook <keescook@chromium.org> Reviewed-by: David Windsor <dwindsor@gmail.com> Reviewed-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> |
||
|---|---|---|
| .. | ||
| blocklayout | ||
| filelayout | ||
| flexfilelayout | ||
| cache_lib.c | ||
| cache_lib.h | ||
| callback.c | ||
| callback.h | ||
| callback_proc.c | ||
| callback_xdr.c | ||
| client.c | ||
| delegation.c | ||
| delegation.h | ||
| dir.c | ||
| direct.c | ||
| dns_resolve.c | ||
| dns_resolve.h | ||
| export.c | ||
| file.c | ||
| fscache-index.c | ||
| fscache.c | ||
| fscache.h | ||
| getroot.c | ||
| inode.c | ||
| internal.h | ||
| io.c | ||
| iostat.h | ||
| Kconfig | ||
| Makefile | ||
| mount_clnt.c | ||
| namespace.c | ||
| netns.h | ||
| nfs.h | ||
| nfs2super.c | ||
| nfs2xdr.c | ||
| nfs3_fs.h | ||
| nfs3acl.c | ||
| nfs3client.c | ||
| nfs3proc.c | ||
| nfs3super.c | ||
| nfs3xdr.c | ||
| nfs4_fs.h | ||
| nfs4client.c | ||
| nfs4file.c | ||
| nfs4getroot.c | ||
| nfs4idmap.c | ||
| nfs4idmap.h | ||
| nfs4namespace.c | ||
| nfs4proc.c | ||
| nfs4renewd.c | ||
| nfs4session.c | ||
| nfs4session.h | ||
| nfs4state.c | ||
| nfs4super.c | ||
| nfs4sysctl.c | ||
| nfs4trace.c | ||
| nfs4trace.h | ||
| nfs4xdr.c | ||
| nfs42.h | ||
| nfs42proc.c | ||
| nfs42xdr.c | ||
| nfsroot.c | ||
| nfstrace.c | ||
| nfstrace.h | ||
| pagelist.c | ||
| pnfs.c | ||
| pnfs.h | ||
| pnfs_dev.c | ||
| pnfs_nfs.c | ||
| proc.c | ||
| read.c | ||
| super.c | ||
| symlink.c | ||
| sysctl.c | ||
| unlink.c | ||
| write.c | ||