btrfs: convert btrfs_root.refs from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
parent
089e77e10d
commit
0700cea7c8
|
@ -1222,7 +1222,7 @@ struct btrfs_root {
|
|||
dev_t anon_dev;
|
||||
|
||||
spinlock_t root_item_lock;
|
||||
atomic_t refs;
|
||||
refcount_t refs;
|
||||
|
||||
struct mutex delalloc_mutex;
|
||||
spinlock_t delalloc_lock;
|
||||
|
|
|
@ -1340,7 +1340,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info,
|
|||
atomic_set(&root->log_writers, 0);
|
||||
atomic_set(&root->log_batch, 0);
|
||||
atomic_set(&root->orphan_inodes, 0);
|
||||
atomic_set(&root->refs, 1);
|
||||
refcount_set(&root->refs, 1);
|
||||
atomic_set(&root->will_be_snapshoted, 0);
|
||||
atomic64_set(&root->qgroup_meta_rsv, 0);
|
||||
root->log_transid = 0;
|
||||
|
|
|
@ -101,14 +101,14 @@ struct btrfs_root *btrfs_alloc_dummy_root(struct btrfs_fs_info *fs_info);
|
|||
*/
|
||||
static inline struct btrfs_root *btrfs_grab_fs_root(struct btrfs_root *root)
|
||||
{
|
||||
if (atomic_inc_not_zero(&root->refs))
|
||||
if (refcount_inc_not_zero(&root->refs))
|
||||
return root;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static inline void btrfs_put_fs_root(struct btrfs_root *root)
|
||||
{
|
||||
if (atomic_dec_and_test(&root->refs))
|
||||
if (refcount_dec_and_test(&root->refs))
|
||||
kfree(root);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue