Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 473e90b2 authored by Elena Reshetova's avatar Elena Reshetova Committed by Thomas Gleixner
Browse files

x86/mce: Convert threshold_bank.cpus from atomic_t to refcount_t 



The refcount_t type and corresponding API should be used instead
of atomic_t when the variable is used as a reference counter. This
allows to avoid accidental refcounter overflows that might lead to
use-after-free situations.

Suggested-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Reviewed-by: default avatarDavid Windsor <dwindsor@gmail.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Yazen Ghannam <Yazen.Ghannam@amd.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/1492695536-5947-1-git-send-email-elena.reshetova@intel.com


Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent 5f0744e5

arch/x86/include/asm/amd_nb.h

+2 −1
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 


#include <linux/ioport.h>

#include <linux/pci.h>

#include <linux/refcount.h>



struct amd_nb_bus_dev_range {

	u8 bus;
@@ -55,7 +56,7 @@ struct threshold_bank { 
	struct threshold_block	*blocks;



	/* initialized to the number of CPUs on the node sharing this bank */

	atomic_t		cpus;

	refcount_t		cpus;

};



struct amd_northbridge {

arch/x86/kernel/cpu/mcheck/mce_amd.c

+3 −3
Original line number Diff line number Diff line
@@ -1202,7 +1202,7 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank) 
				goto out;



			per_cpu(threshold_banks, cpu)[bank] = b;

			atomic_inc(&b->cpus);

			refcount_inc(&b->cpus);



			err = __threshold_add_blocks(b);
@@ -1225,7 +1225,7 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank) 
	per_cpu(threshold_banks, cpu)[bank] = b;



	if (is_shared_bank(bank)) {

		atomic_set(&b->cpus, 1);

		refcount_set(&b->cpus, 1);



		/* nb is already initialized, see above */

		if (nb) {
@@ -1289,7 +1289,7 @@ static void threshold_remove_bank(unsigned int cpu, int bank) 
		goto free_out;



	if (is_shared_bank(bank)) {

		if (!atomic_dec_and_test(&b->cpus)) {

		if (!refcount_dec_and_test(&b->cpus)) {

			__threshold_remove_blocks(b);

			per_cpu(threshold_banks, cpu)[bank] = NULL;

			return;