diff mbox series

[PATCHv2] refcount: always allow checked forms

Message ID 20180711093607.1644-1-mark.rutland@arm.com
State Accepted
Commit afed7bcf9487bb28e2e2b016a195085c07416c0b
Headers show
Series [PATCHv2] refcount: always allow checked forms | expand

Commit Message

Mark Rutland July 11, 2018, 9:36 a.m. UTC 
In many cases, it would be useful to be able to use the full
sanity-checked refcount helpers regardless of CONFIG_REFCOUNT_FULL, as
this would help to avoid duplicate warnings where callers try to
sanity-check refcount manipulation.

This patch refactors things such that the full refcount helpers were
always built, as refcount_${op}_checked(), such that they can be used
regardless of CONFIG_REFCOUNT_FULL. This will allow code which *always*
wants a checked refcount to opt-in, avoiding the need to duplicate the
logic for warnings.

There should be no functional change as a result of this patch.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>

Acked-by: Kees Cook <keescook@chromium.org>

Reviewed-by: David Sterba <dsterba@suse.com>

Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will.deacon@arm.com>
---
 include/linux/refcount.h | 27 +++++++++++++++++-------
 lib/refcount.c           | 53 +++++++++++++++++++++++-------------------------
 2 files changed, 45 insertions(+), 35 deletions(-)

Since v1 [1]:
* Fix refcount_inc_checked() name
* Accumulate acks

Kees, per your reply [2], I'm assuming that either you or David will end up
picking this up as part of a series usingthe checked forms.

Mark.

[1] https://lkml.kernel.org/r/20180703100102.16615-1-mark.rutland@arm.com
[2] https://lkml.kernel.org/r/CAGXu5jLATGcq_mgetUurBriCaPmBQmBwxVW7aa9fAKM2XeSjHw@mail.gmail.com

-- 
2.11.0

Comments

Will Deacon July 12, 2018, 5:01 p.m. UTC | #1 
On Wed, Jul 11, 2018 at 10:36:07AM +0100, Mark Rutland wrote:
> In many cases, it would be useful to be able to use the full

> sanity-checked refcount helpers regardless of CONFIG_REFCOUNT_FULL, as

> this would help to avoid duplicate warnings where callers try to

> sanity-check refcount manipulation.

> 

> This patch refactors things such that the full refcount helpers were

> always built, as refcount_${op}_checked(), such that they can be used

> regardless of CONFIG_REFCOUNT_FULL. This will allow code which *always*

> wants a checked refcount to opt-in, avoiding the need to duplicate the

> logic for warnings.

> 

> There should be no functional change as a result of this patch.

> 

> Signed-off-by: Mark Rutland <mark.rutland@arm.com>

> Acked-by: Kees Cook <keescook@chromium.org>

> Reviewed-by: David Sterba <dsterba@suse.com>

> Cc: Boqun Feng <boqun.feng@gmail.com>

> Cc: Ingo Molnar <mingo@kernel.org>

> Cc: Peter Zijlstra <peterz@infradead.org>

> Cc: Will Deacon <will.deacon@arm.com>

> ---

>  include/linux/refcount.h | 27 +++++++++++++++++-------

>  lib/refcount.c           | 53 +++++++++++++++++++++++-------------------------

>  2 files changed, 45 insertions(+), 35 deletions(-)


Looks good to me:

Acked-by: Will Deacon <will.deacon@arm.com>


Will
Kees Cook July 12, 2018, 7:50 p.m. UTC | #2 
On Thu, Jul 12, 2018 at 10:01 AM, Will Deacon <will.deacon@arm.com> wrote:
> On Wed, Jul 11, 2018 at 10:36:07AM +0100, Mark Rutland wrote:

>> In many cases, it would be useful to be able to use the full

>> sanity-checked refcount helpers regardless of CONFIG_REFCOUNT_FULL, as

>> this would help to avoid duplicate warnings where callers try to

>> sanity-check refcount manipulation.

>>

>> This patch refactors things such that the full refcount helpers were

>> always built, as refcount_${op}_checked(), such that they can be used

>> regardless of CONFIG_REFCOUNT_FULL. This will allow code which *always*

>> wants a checked refcount to opt-in, avoiding the need to duplicate the

>> logic for warnings.

>>

>> There should be no functional change as a result of this patch.

>>

>> Signed-off-by: Mark Rutland <mark.rutland@arm.com>

>> Acked-by: Kees Cook <keescook@chromium.org>

>> Reviewed-by: David Sterba <dsterba@suse.com>

>> Cc: Boqun Feng <boqun.feng@gmail.com>

>> Cc: Ingo Molnar <mingo@kernel.org>

>> Cc: Peter Zijlstra <peterz@infradead.org>

>> Cc: Will Deacon <will.deacon@arm.com>

>> ---

>>  include/linux/refcount.h | 27 +++++++++++++++++-------

>>  lib/refcount.c           | 53 +++++++++++++++++++++++-------------------------

>>  2 files changed, 45 insertions(+), 35 deletions(-)

>

> Looks good to me:

>

> Acked-by: Will Deacon <will.deacon@arm.com>


Peter, Ingo, can this go via the atomics tree? That's been the
traditional location for the refcount patches.

Thanks!

-Kees

-- 
Kees Cook
Pixel Security
Ingo Molnar July 12, 2018, 9:34 p.m. UTC | #3 
* Kees Cook <keescook@chromium.org> wrote:

> On Thu, Jul 12, 2018 at 10:01 AM, Will Deacon <will.deacon@arm.com> wrote:

> > On Wed, Jul 11, 2018 at 10:36:07AM +0100, Mark Rutland wrote:

> >> In many cases, it would be useful to be able to use the full

> >> sanity-checked refcount helpers regardless of CONFIG_REFCOUNT_FULL, as

> >> this would help to avoid duplicate warnings where callers try to

> >> sanity-check refcount manipulation.

> >>

> >> This patch refactors things such that the full refcount helpers were

> >> always built, as refcount_${op}_checked(), such that they can be used

> >> regardless of CONFIG_REFCOUNT_FULL. This will allow code which *always*

> >> wants a checked refcount to opt-in, avoiding the need to duplicate the

> >> logic for warnings.

> >>

> >> There should be no functional change as a result of this patch.

> >>

> >> Signed-off-by: Mark Rutland <mark.rutland@arm.com>

> >> Acked-by: Kees Cook <keescook@chromium.org>

> >> Reviewed-by: David Sterba <dsterba@suse.com>

> >> Cc: Boqun Feng <boqun.feng@gmail.com>

> >> Cc: Ingo Molnar <mingo@kernel.org>

> >> Cc: Peter Zijlstra <peterz@infradead.org>

> >> Cc: Will Deacon <will.deacon@arm.com>

> >> ---

> >>  include/linux/refcount.h | 27 +++++++++++++++++-------

> >>  lib/refcount.c           | 53 +++++++++++++++++++++++-------------------------

> >>  2 files changed, 45 insertions(+), 35 deletions(-)

> >

> > Looks good to me:

> >

> > Acked-by: Will Deacon <will.deacon@arm.com>

> 

> Peter, Ingo, can this go via the atomics tree? That's been the

> traditional location for the refcount patches.


Sure, will have a look tomorrow!

	Ingo
diff mbox series

Patch

diff --git a/include/linux/refcount.h b/include/linux/refcount.h
index a685da2c4522..b505f75ccf68 100644
--- a/include/linux/refcount.h
+++ b/include/linux/refcount.h
@@ -42,17 +42,30 @@  static inline unsigned int refcount_read(const refcount_t *r)
 	return atomic_read(&r->refs);
 }
 
+extern __must_check bool refcount_add_not_zero_checked(unsigned int i, refcount_t *r);
+extern void refcount_add_checked(unsigned int i, refcount_t *r);
+
+extern __must_check bool refcount_inc_not_zero_checked(refcount_t *r);
+extern void refcount_inc_checked(refcount_t *r);
+
+extern __must_check bool refcount_sub_and_test_checked(unsigned int i, refcount_t *r);
+
+extern __must_check bool refcount_dec_and_test_checked(refcount_t *r);
+extern void refcount_dec_checked(refcount_t *r);
+
 #ifdef CONFIG_REFCOUNT_FULL
-extern __must_check bool refcount_add_not_zero(unsigned int i, refcount_t *r);
-extern void refcount_add(unsigned int i, refcount_t *r);
 
-extern __must_check bool refcount_inc_not_zero(refcount_t *r);
-extern void refcount_inc(refcount_t *r);
+#define refcount_add_not_zero	refcount_add_not_zero_checked
+#define refcount_add		refcount_add_checked
+
+#define refcount_inc_not_zero	refcount_inc_not_zero_checked
+#define refcount_inc		refcount_inc_checked
+
+#define refcount_sub_and_test	refcount_sub_and_test_checked
 
-extern __must_check bool refcount_sub_and_test(unsigned int i, refcount_t *r);
+#define refcount_dec_and_test	refcount_dec_and_test_checked
+#define refcount_dec		refcount_dec_checked
 
-extern __must_check bool refcount_dec_and_test(refcount_t *r);
-extern void refcount_dec(refcount_t *r);
 #else
 # ifdef CONFIG_ARCH_HAS_REFCOUNT
 #  include <asm/refcount.h>
diff --git a/lib/refcount.c b/lib/refcount.c
index d3b81cefce91..c042e0c90462 100644
--- a/lib/refcount.c
+++ b/lib/refcount.c
@@ -38,10 +38,8 @@ 
 #include <linux/refcount.h>
 #include <linux/bug.h>
 
-#ifdef CONFIG_REFCOUNT_FULL
-
 /**
- * refcount_add_not_zero - add a value to a refcount unless it is 0
+ * refcount_add_not_zero_checked - add a value to a refcount unless it is 0
  * @i: the value to add to the refcount
  * @r: the refcount
  *
@@ -58,7 +56,7 @@ 
  *
  * Return: false if the passed refcount is 0, true otherwise
  */
-bool refcount_add_not_zero(unsigned int i, refcount_t *r)
+bool refcount_add_not_zero_checked(unsigned int i, refcount_t *r)
 {
 	unsigned int new, val = atomic_read(&r->refs);
 
@@ -79,10 +77,10 @@  bool refcount_add_not_zero(unsigned int i, refcount_t *r)
 
 	return true;
 }
-EXPORT_SYMBOL(refcount_add_not_zero);
+EXPORT_SYMBOL(refcount_add_not_zero_checked);
 
 /**
- * refcount_add - add a value to a refcount
+ * refcount_add_checked - add a value to a refcount
  * @i: the value to add to the refcount
  * @r: the refcount
  *
@@ -97,14 +95,14 @@  EXPORT_SYMBOL(refcount_add_not_zero);
  * cases, refcount_inc(), or one of its variants, should instead be used to
  * increment a reference count.
  */
-void refcount_add(unsigned int i, refcount_t *r)
+void refcount_add_checked(unsigned int i, refcount_t *r)
 {
-	WARN_ONCE(!refcount_add_not_zero(i, r), "refcount_t: addition on 0; use-after-free.\n");
+	WARN_ONCE(!refcount_add_not_zero_checked(i, r), "refcount_t: addition on 0; use-after-free.\n");
 }
-EXPORT_SYMBOL(refcount_add);
+EXPORT_SYMBOL(refcount_add_checked);
 
 /**
- * refcount_inc_not_zero - increment a refcount unless it is 0
+ * refcount_inc_not_zero_checked - increment a refcount unless it is 0
  * @r: the refcount to increment
  *
  * Similar to atomic_inc_not_zero(), but will saturate at UINT_MAX and WARN.
@@ -115,7 +113,7 @@  EXPORT_SYMBOL(refcount_add);
  *
  * Return: true if the increment was successful, false otherwise
  */
-bool refcount_inc_not_zero(refcount_t *r)
+bool refcount_inc_not_zero_checked(refcount_t *r)
 {
 	unsigned int new, val = atomic_read(&r->refs);
 
@@ -134,10 +132,10 @@  bool refcount_inc_not_zero(refcount_t *r)
 
 	return true;
 }
-EXPORT_SYMBOL(refcount_inc_not_zero);
+EXPORT_SYMBOL(refcount_inc_not_zero_checked);
 
 /**
- * refcount_inc - increment a refcount
+ * refcount_inc_checked - increment a refcount
  * @r: the refcount to increment
  *
  * Similar to atomic_inc(), but will saturate at UINT_MAX and WARN.
@@ -148,14 +146,14 @@  EXPORT_SYMBOL(refcount_inc_not_zero);
  * Will WARN if the refcount is 0, as this represents a possible use-after-free
  * condition.
  */
-void refcount_inc(refcount_t *r)
+void refcount_inc_checked(refcount_t *r)
 {
-	WARN_ONCE(!refcount_inc_not_zero(r), "refcount_t: increment on 0; use-after-free.\n");
+	WARN_ONCE(!refcount_inc_not_zero_checked(r), "refcount_t: increment on 0; use-after-free.\n");
 }
-EXPORT_SYMBOL(refcount_inc);
+EXPORT_SYMBOL(refcount_inc_checked);
 
 /**
- * refcount_sub_and_test - subtract from a refcount and test if it is 0
+ * refcount_sub_and_test_checked - subtract from a refcount and test if it is 0
  * @i: amount to subtract from the refcount
  * @r: the refcount
  *
@@ -174,7 +172,7 @@  EXPORT_SYMBOL(refcount_inc);
  *
  * Return: true if the resulting refcount is 0, false otherwise
  */
-bool refcount_sub_and_test(unsigned int i, refcount_t *r)
+bool refcount_sub_and_test_checked(unsigned int i, refcount_t *r)
 {
 	unsigned int new, val = atomic_read(&r->refs);
 
@@ -192,10 +190,10 @@  bool refcount_sub_and_test(unsigned int i, refcount_t *r)
 
 	return !new;
 }
-EXPORT_SYMBOL(refcount_sub_and_test);
+EXPORT_SYMBOL(refcount_sub_and_test_checked);
 
 /**
- * refcount_dec_and_test - decrement a refcount and test if it is 0
+ * refcount_dec_and_test_checked - decrement a refcount and test if it is 0
  * @r: the refcount
  *
  * Similar to atomic_dec_and_test(), it will WARN on underflow and fail to
@@ -207,14 +205,14 @@  EXPORT_SYMBOL(refcount_sub_and_test);
  *
  * Return: true if the resulting refcount is 0, false otherwise
  */
-bool refcount_dec_and_test(refcount_t *r)
+bool refcount_dec_and_test_checked(refcount_t *r)
 {
-	return refcount_sub_and_test(1, r);
+	return refcount_sub_and_test_checked(1, r);
 }
-EXPORT_SYMBOL(refcount_dec_and_test);
+EXPORT_SYMBOL(refcount_dec_and_test_checked);
 
 /**
- * refcount_dec - decrement a refcount
+ * refcount_dec_checked - decrement a refcount
  * @r: the refcount
  *
  * Similar to atomic_dec(), it will WARN on underflow and fail to decrement
@@ -223,12 +221,11 @@  EXPORT_SYMBOL(refcount_dec_and_test);
  * Provides release memory ordering, such that prior loads and stores are done
  * before.
  */
-void refcount_dec(refcount_t *r)
+void refcount_dec_checked(refcount_t *r)
 {
-	WARN_ONCE(refcount_dec_and_test(r), "refcount_t: decrement hit 0; leaking memory.\n");
+	WARN_ONCE(refcount_dec_and_test_checked(r), "refcount_t: decrement hit 0; leaking memory.\n");
 }
-EXPORT_SYMBOL(refcount_dec);
-#endif /* CONFIG_REFCOUNT_FULL */
+EXPORT_SYMBOL(refcount_dec_checked);
 
 /**
  * refcount_dec_if_one - decrement a refcount if it is 1