Messages in this thread | | | Date | Fri, 18 Aug 2023 15:29:54 +0200 | From | Christian Brauner <> | Subject | Re: [PATCH v2] nsproxy: Convert nsproxy.count to refcount_t |
| |
On Thu, Aug 17, 2023 at 09:13:32PM -0700, Kees Cook wrote: > From: Elena Reshetova <elena.reshetova@intel.com> > > atomic_t variables are currently used to implement reference counters > with the following properties: > - counter is initialized to 1 using atomic_set() > - a resource is freed upon counter reaching zero > - once counter reaches zero, its further > increments aren't allowed > - counter schema uses basic atomic operations > (set, inc, inc_not_zero, dec_and_test, etc.) > > Such atomic variables should be converted to a newly provided > refcount_t type and API that prevents accidental counter overflows and > underflows. This is important since overflows and underflows can lead > to use-after-free situation and be exploitable. > > The variable nsproxy.count is used as pure reference counter. Convert it > to refcount_t and fix up the operations. > > **Important note for maintainers: > > Some functions from refcount_t API defined in refcount.h have different > memory ordering guarantees than their atomic counterparts. Please check > Documentation/core-api/refcount-vs-atomic.rst for more information. > > Normally the differences should not matter since refcount_t provides > enough guarantees to satisfy the refcounting use cases, but in some > rare cases it might matter. Please double check that you don't have > some undocumented memory guarantees for this variable usage. > > For the nsproxy.count it might make a difference in following places: > - put_nsproxy() and switch_task_namespaces(): decrement in > refcount_dec_and_test() only provides RELEASE ordering and ACQUIRE > ordering on success vs. fully ordered atomic counterpart > > Suggested-by: Kees Cook <keescook@chromium.org> > Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> > Reviewed-by: David Windsor <dwindsor@gmail.com> > Reviewed-by: Hans Liljestrand <ishkamiel@gmail.com> > Signed-off-by: Kees Cook <keescook@chromium.org> > ---
Reviewed-by: Christian Brauner <brauner@kernel.org>
| |