locking/refcount: Define constants for saturation and max refcount values

#include "lkdtm.h"

#include <linux/refcount.h>

#ifdef CONFIG_REFCOUNT_FULL

#define REFCOUNT_MAX		(UINT_MAX - 1)

#define REFCOUNT_SATURATED	UINT_MAX

#else

#define REFCOUNT_MAX		INT_MAX

#define REFCOUNT_SATURATED	(INT_MIN / 2)

#endif

static void overflow_check(refcount_t *ref)

{

	switch (refcount_read(ref)) {

#include <linux/atomic.h>

#include <linux/compiler.h>

#include <linux/limits.h>

#include <linux/spinlock_types.h>

struct mutex;

 * refcount_t - variant of atomic_t specialized for reference counts

 * @refs: atomic_t counter field

 *

 * The counter saturates at UINT_MAX and will not move once

 * The counter saturates at REFCOUNT_SATURATED and will not move once

 * there. This avoids wrapping the counter and causing 'spurious'

 * use-after-free bugs.

 */

#ifdef CONFIG_REFCOUNT_FULL

#define REFCOUNT_MAX		(UINT_MAX - 1)

#define REFCOUNT_SATURATED	UINT_MAX

#define refcount_add_not_zero	refcount_add_not_zero_checked

#define refcount_add		refcount_add_checked

#define refcount_dec		refcount_dec_checked

#else

#define REFCOUNT_MAX		INT_MAX

#define REFCOUNT_SATURATED	(INT_MIN / 2)

# ifdef CONFIG_ARCH_HAS_REFCOUNT

#  include <asm/refcount.h>

# else

static inline __must_check bool refcount_add_not_zero(unsigned int i, refcount_t *r)

{

	return atomic_add_unless(&r->refs, i, 0);

 * The interface matches the atomic_t interface (to aid in porting) but only

 * provides the few functions one should use for reference counting.

 *

 * It differs in that the counter saturates at UINT_MAX and will not move once

 * there. This avoids wrapping the counter and causing 'spurious'

 * It differs in that the counter saturates at REFCOUNT_SATURATED and will not

 * move once there. This avoids wrapping the counter and causing 'spurious'

 * use-after-free issues.

 *

 * Memory ordering rules are slightly relaxed wrt regular atomic_t functions

 * @i: the value to add to the refcount

 * @r: the refcount

 *

 * Will saturate at UINT_MAX and WARN.

 * Will saturate at REFCOUNT_SATURATED and WARN.

 *

 * Provides no memory ordering, it is assumed the caller has guaranteed the

 * object memory to be stable (RCU, etc.). It does provide a control dependency

		if (!val)

			return false;

		if (unlikely(val == UINT_MAX))

		if (unlikely(val == REFCOUNT_SATURATED))

			return true;

		new = val + i;

		if (new < val)

			new = UINT_MAX;

			new = REFCOUNT_SATURATED;

	} while (!atomic_try_cmpxchg_relaxed(&r->refs, &val, new));

	WARN_ONCE(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");

	WARN_ONCE(new == REFCOUNT_SATURATED,

		  "refcount_t: saturated; leaking memory.\n");

	return true;

}

 * @i: the value to add to the refcount

 * @r: the refcount

 *

 * Similar to atomic_add(), but will saturate at UINT_MAX and WARN.

 * Similar to atomic_add(), but will saturate at REFCOUNT_SATURATED and WARN.

 *

 * Provides no memory ordering, it is assumed the caller has guaranteed the

 * object memory to be stable (RCU, etc.). It does provide a control dependency

 * refcount_inc_not_zero_checked - increment a refcount unless it is 0

 * @r: the refcount to increment

 *

 * Similar to atomic_inc_not_zero(), but will saturate at UINT_MAX and WARN.

 * Similar to atomic_inc_not_zero(), but will saturate at REFCOUNT_SATURATED

 * and WARN.

 *

 * Provides no memory ordering, it is assumed the caller has guaranteed the

 * object memory to be stable (RCU, etc.). It does provide a control dependency

	} while (!atomic_try_cmpxchg_relaxed(&r->refs, &val, new));

	WARN_ONCE(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");

	WARN_ONCE(new == REFCOUNT_SATURATED,

		  "refcount_t: saturated; leaking memory.\n");

	return true;

}

 * refcount_inc_checked - increment a refcount

 * @r: the refcount to increment

 *

 * Similar to atomic_inc(), but will saturate at UINT_MAX and WARN.

 * Similar to atomic_inc(), but will saturate at REFCOUNT_SATURATED and WARN.

 *

 * Provides no memory ordering, it is assumed the caller already has a

 * reference on the object.

 *

 * Similar to atomic_dec_and_test(), but it will WARN, return false and

 * ultimately leak on underflow and will fail to decrement when saturated

 * at UINT_MAX.

 * at REFCOUNT_SATURATED.

 *

 * Provides release memory ordering, such that prior loads and stores are done

 * before, and provides an acquire ordering on success such that free()

	unsigned int new, val = atomic_read(&r->refs);

	do {

		if (unlikely(val == UINT_MAX))

		if (unlikely(val == REFCOUNT_SATURATED))

			return false;

		new = val - i;

 * @r: the refcount

 *

 * Similar to atomic_dec_and_test(), it will WARN on underflow and fail to

 * decrement when saturated at UINT_MAX.

 * decrement when saturated at REFCOUNT_SATURATED.

 *

 * Provides release memory ordering, such that prior loads and stores are done

 * before, and provides an acquire ordering on success such that free()

 * @r: the refcount

 *

 * Similar to atomic_dec(), it will WARN on underflow and fail to decrement

 * when saturated at UINT_MAX.

 * when saturated at REFCOUNT_SATURATED.

 *

 * Provides release memory ordering, such that prior loads and stores are done

 * before.

	unsigned int new, val = atomic_read(&r->refs);

	do {

		if (unlikely(val == UINT_MAX))

		if (unlikely(val == REFCOUNT_SATURATED))

			return true;

		if (val == 1)

 * @lock: the mutex to be locked

 *

 * Similar to atomic_dec_and_mutex_lock(), it will WARN on underflow and fail

 * to decrement when saturated at UINT_MAX.

 * to decrement when saturated at REFCOUNT_SATURATED.

 *

 * Provides release memory ordering, such that prior loads and stores are done

 * before, and provides a control dependency such that free() must come after.

 * @lock: the spinlock to be locked

 *

 * Similar to atomic_dec_and_lock(), it will WARN on underflow and fail to

 * decrement when saturated at UINT_MAX.

 * decrement when saturated at REFCOUNT_SATURATED.

 *

 * Provides release memory ordering, such that prior loads and stores are done

 * before, and provides a control dependency such that free() must come after.