Messages in this thread | | | Date | Sun, 18 Jul 2021 13:44:30 +0300 | From | Leon Romanovsky <> | Subject | Re: [PATCH] cxgb4: Convert from atomic_t to refcount_t on l2t_entry->refcnt |
| |
On Sat, Jul 17, 2021 at 06:16:54PM +0800, Xiyu Yang wrote: > refcount_t type and corresponding API can protect refcounters from > accidental underflow and overflow and further use-after-free situations. > > Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> > Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> > --- > drivers/net/ethernet/chelsio/cxgb4/l2t.c | 31 ++++++++++++++++--------------- > drivers/net/ethernet/chelsio/cxgb4/l2t.h | 3 ++- > 2 files changed, 18 insertions(+), 16 deletions(-) > > diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c > index a10a6862a9a4..cb26a5e315b1 100644 > --- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c > +++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c > @@ -69,7 +69,8 @@ static inline unsigned int vlan_prio(const struct l2t_entry *e) > > static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e) > { > - if (atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */ > + refcount_inc(&e->refcnt); > + if (refcount_read(&e->refcnt) == 1) /* 0 -> 1 transition */ > atomic_dec(&d->nfree); > } > > @@ -270,10 +271,10 @@ static struct l2t_entry *alloc_l2e(struct l2t_data *d) > > /* there's definitely a free entry */ > for (e = d->rover, end = &d->l2tab[d->l2t_size]; e != end; ++e) > - if (atomic_read(&e->refcnt) == 0) > + if (refcount_read(&e->refcnt) == 0)
This is wrong.
Thanks
| |