Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 140475ae authored by Elena Reshetova's avatar Elena Reshetova Committed by David Sterba
Browse files

btrfs: convert btrfs_bio.refs from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent f95fda87

fs/btrfs/volumes.c

+4 −4
Original line number Diff line number Diff line
@@ -5301,22 +5301,22 @@ static struct btrfs_bio *alloc_btrfs_bio(int total_stripes, int real_stripes) 
		GFP_NOFS|__GFP_NOFAIL);



	atomic_set(&bbio->error, 0);

	atomic_set(&bbio->refs, 1);

	refcount_set(&bbio->refs, 1);



	return bbio;

}



void btrfs_get_bbio(struct btrfs_bio *bbio)

{

	WARN_ON(!atomic_read(&bbio->refs));

	atomic_inc(&bbio->refs);

	WARN_ON(!refcount_read(&bbio->refs));

	refcount_inc(&bbio->refs);

}



void btrfs_put_bbio(struct btrfs_bio *bbio)

{

	if (!bbio)

		return;

	if (atomic_dec_and_test(&bbio->refs))

	if (refcount_dec_and_test(&bbio->refs))

		kfree(bbio);

}

fs/btrfs/volumes.h

+1 −1
Original line number Diff line number Diff line
@@ -298,7 +298,7 @@ struct btrfs_bio; 
typedef void (btrfs_bio_end_io_t) (struct btrfs_bio *bio, int err);



struct btrfs_bio {

	atomic_t refs;

	refcount_t refs;

	atomic_t stripes_pending;

	struct btrfs_fs_info *fs_info;

	u64 map_type; /* get from map_lookup->type */