Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78a76450 authored by Elena Reshetova's avatar Elena Reshetova Committed by David Sterba
Browse files

btrfs: convert scrub_parity.refs from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 186debd6

fs/btrfs/scrub.c

+4 −4
Original line number Diff line number Diff line
@@ -142,7 +142,7 @@ struct scrub_parity { 


	int			stripe_len;



	atomic_t		refs;

	refcount_t		refs;



	struct list_head	spages;
@@ -2822,12 +2822,12 @@ static inline int scrub_calc_parity_bitmap_len(int nsectors) 


static void scrub_parity_get(struct scrub_parity *sparity)

{

	atomic_inc(&sparity->refs);

	refcount_inc(&sparity->refs);

}



static void scrub_parity_put(struct scrub_parity *sparity)

{

	if (!atomic_dec_and_test(&sparity->refs))

	if (!refcount_dec_and_test(&sparity->refs))

		return;



	scrub_parity_check_and_repair(sparity);
@@ -2879,7 +2879,7 @@ static noinline_for_stack int scrub_raid56_parity(struct scrub_ctx *sctx, 
	sparity->scrub_dev = sdev;

	sparity->logic_start = logic_start;

	sparity->logic_end = logic_end;

	atomic_set(&sparity->refs, 1);

	refcount_set(&sparity->refs, 1);

	INIT_LIST_HEAD(&sparity->spages);

	sparity->dbitmap = sparity->bitmap;

	sparity->ebitmap = (void *)sparity->bitmap + bitmap_len;