Re: [PATCH] mm/mempolicy: Convert from atomic_t to refcount_t on mempolicy->refcnt

[Ben Widawsky]

On 21-07-19 16:34:28, Xiyu Yang wrote:
> refcount_t type and corresponding API can protect refcounters from
> accidental underflow and overflow and further use-after-free situations.
> 
> Signed-off-by: Xiyu Yang <xiyuyang19@xxxxxxxxxxxx>
> Signed-off-by: Xin Tan <tanxin.ctf@xxxxxxxxx>

lgtm

Acked-by: Ben Widawsky <ben.widawsky@xxxxxxxxx>

> ---
>  include/linux/mempolicy.h | 5 +++--
>  mm/mempolicy.c            | 8 ++++----
>  2 files changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> index 0aaf91b496e2..faec94994eb7 100644
> --- a/include/linux/mempolicy.h
> +++ b/include/linux/mempolicy.h
> @@ -6,6 +6,7 @@
>  #ifndef _LINUX_MEMPOLICY_H
>  #define _LINUX_MEMPOLICY_H 1
>  
> +#include <linux/refcount.h>
>  #include <linux/sched.h>
>  #include <linux/mmzone.h>
>  #include <linux/dax.h>
> @@ -43,7 +44,7 @@ struct mm_struct;
>   * to 1, representing the caller of mpol_dup().
>   */
>  struct mempolicy {
> -	atomic_t refcnt;
> +	refcount_t refcnt;
>  	unsigned short mode; 	/* See MPOL_* above */
>  	unsigned short flags;	/* See set_mempolicy() MPOL_F_* above */
>  	nodemask_t nodes;	/* interleave/bind/perfer */
> @@ -94,7 +95,7 @@ static inline struct mempolicy *mpol_dup(struct mempolicy *pol)
>  static inline void mpol_get(struct mempolicy *pol)
>  {
>  	if (pol)
> -		atomic_inc(&pol->refcnt);
> +		refcount_inc(&pol->refcnt);
>  }
>  
>  extern bool __mpol_equal(struct mempolicy *a, struct mempolicy *b);
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index e32360e90274..829a14f34b43 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -298,7 +298,7 @@ static struct mempolicy *mpol_new(unsigned short mode, unsigned short flags,
>  	policy = kmem_cache_alloc(policy_cache, GFP_KERNEL);
>  	if (!policy)
>  		return ERR_PTR(-ENOMEM);
> -	atomic_set(&policy->refcnt, 1);
> +	refcount_set(&policy->refcnt, 1);
>  	policy->mode = mode;
>  	policy->flags = flags;
>  
> @@ -308,7 +308,7 @@ static struct mempolicy *mpol_new(unsigned short mode, unsigned short flags,
>  /* Slow path of a mpol destructor. */
>  void __mpol_put(struct mempolicy *p)
>  {
> -	if (!atomic_dec_and_test(&p->refcnt))
> +	if (!refcount_dec_and_test(&p->refcnt))
>  		return;
>  	kmem_cache_free(policy_cache, p);
>  }
> @@ -2290,7 +2290,7 @@ struct mempolicy *__mpol_dup(struct mempolicy *old)
>  		nodemask_t mems = cpuset_mems_allowed(current);
>  		mpol_rebind_policy(new, &mems);
>  	}
> -	atomic_set(&new->refcnt, 1);
> +	refcount_set(&new->refcnt, 1);
>  	return new;
>  }
>  
> @@ -2581,7 +2581,7 @@ static int shared_policy_replace(struct shared_policy *sp, unsigned long start,
>  					goto alloc_new;
>  
>  				*mpol_new = *n->policy;
> -				atomic_set(&mpol_new->refcnt, 1);
> +				refcount_set(&mpol_new->refcnt, 1);
>  				sp_node_init(n_new, end, n->end, mpol_new);
>  				n->end = start;
>  				sp_insert(sp, n_new);
> -- 
> 2.7.4
>