Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

RDMA/core: Use refcount_t instead of atomic_t on refcount of ib_uverbs_device

The refcount_t API will WARN on underflow and overflow of a reference
counter, and avoid use-after-free risks.

Link: https://lore.kernel.org/r/1622194663-2383-8-git-send-email-liweihang@huawei.com
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

authored by

Weihang Li and committed by
Jason Gunthorpe
ec9bf373 a5e27fb6

+7 -7
+1 -1
drivers/infiniband/core/uverbs.h
··· 97 97 */ 98 98 99 99 struct ib_uverbs_device { 100 - atomic_t refcount; 100 + refcount_t refcount; 101 101 u32 num_comp_vectors; 102 102 struct completion comp; 103 103 struct device dev;
+6 -6
drivers/infiniband/core/uverbs_main.c
··· 197 197 module_put(ib_dev->ops.owner); 198 198 srcu_read_unlock(&file->device->disassociate_srcu, srcu_key); 199 199 200 - if (atomic_dec_and_test(&file->device->refcount)) 200 + if (refcount_dec_and_test(&file->device->refcount)) 201 201 ib_uverbs_comp_dev(file->device); 202 202 203 203 if (file->default_async_file) ··· 891 891 int srcu_key; 892 892 893 893 dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev); 894 - if (!atomic_inc_not_zero(&dev->refcount)) 894 + if (!refcount_inc_not_zero(&dev->refcount)) 895 895 return -ENXIO; 896 896 897 897 get_device(&dev->dev); ··· 955 955 err: 956 956 mutex_unlock(&dev->lists_mutex); 957 957 srcu_read_unlock(&dev->disassociate_srcu, srcu_key); 958 - if (atomic_dec_and_test(&dev->refcount)) 958 + if (refcount_dec_and_test(&dev->refcount)) 959 959 ib_uverbs_comp_dev(dev); 960 960 961 961 put_device(&dev->dev); ··· 1124 1124 uverbs_dev->dev.release = ib_uverbs_release_dev; 1125 1125 uverbs_dev->groups[0] = &dev_attr_group; 1126 1126 uverbs_dev->dev.groups = uverbs_dev->groups; 1127 - atomic_set(&uverbs_dev->refcount, 1); 1127 + refcount_set(&uverbs_dev->refcount, 1); 1128 1128 init_completion(&uverbs_dev->comp); 1129 1129 uverbs_dev->xrcd_tree = RB_ROOT; 1130 1130 mutex_init(&uverbs_dev->xrcd_tree_mutex); ··· 1166 1166 err_uapi: 1167 1167 ida_free(&uverbs_ida, devnum); 1168 1168 err: 1169 - if (atomic_dec_and_test(&uverbs_dev->refcount)) 1169 + if (refcount_dec_and_test(&uverbs_dev->refcount)) 1170 1170 ib_uverbs_comp_dev(uverbs_dev); 1171 1171 wait_for_completion(&uverbs_dev->comp); 1172 1172 put_device(&uverbs_dev->dev); ··· 1229 1229 wait_clients = 0; 1230 1230 } 1231 1231 1232 - if (atomic_dec_and_test(&uverbs_dev->refcount)) 1232 + if (refcount_dec_and_test(&uverbs_dev->refcount)) 1233 1233 ib_uverbs_comp_dev(uverbs_dev); 1234 1234 if (wait_clients) 1235 1235 wait_for_completion(&uverbs_dev->comp);