lkml.org 
[lkml]   [2012]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 22/25] Generic dynamic per cpu refcounting
On Thu, Nov 29, 2012 at 02:34:52PM -0500, Benjamin LaHaise wrote:
> On Thu, Nov 29, 2012 at 11:29:25AM -0800, Kent Overstreet wrote:
> > There's some kind of symmetry going on here, and if I'd been awake more
> > in college I could probably say exactly why it works, but it does.
>
> I think the catch is that using only a 32 bit counter is something the
> user could arbitrarily control the sum of all parts. I think a 64 bit
> counter may be required to ensure no overflow occurs. Otherwise, an
> overflow could result in a premature free when there are still 2^32
> objects active thanks to a malicious user (possible on systems with lots
> of memory these days -- remote, but possible).

That's no different from regular atomic_t - but you're right, we
should be using size_t for anything userspace can manipulate.

Not gonna worry about it in this patch though because the refcount was
an atomic_t before and userspace can only do one get per thread.


\
 
 \ /
  Last update: 2012-11-29 22:01    [W:0.071 / U:0.156 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site