Commit a50299ae authored by Elena Reshetova's avatar Elena Reshetova Committed by David Sterba

btrfs: convert compressed_bio.pending_bios from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent b7ac31b7
...@@ -44,7 +44,7 @@ ...@@ -44,7 +44,7 @@
struct compressed_bio { struct compressed_bio {
/* number of bios pending for this compressed extent */ /* number of bios pending for this compressed extent */
atomic_t pending_bios; refcount_t pending_bios;
/* the pages with the compressed data on them */ /* the pages with the compressed data on them */
struct page **compressed_pages; struct page **compressed_pages;
...@@ -161,7 +161,7 @@ static void end_compressed_bio_read(struct bio *bio) ...@@ -161,7 +161,7 @@ static void end_compressed_bio_read(struct bio *bio)
/* if there are more bios still pending for this compressed /* if there are more bios still pending for this compressed
* extent, just exit * extent, just exit
*/ */
if (!atomic_dec_and_test(&cb->pending_bios)) if (!refcount_dec_and_test(&cb->pending_bios))
goto out; goto out;
inode = cb->inode; inode = cb->inode;
...@@ -274,7 +274,7 @@ static void end_compressed_bio_write(struct bio *bio) ...@@ -274,7 +274,7 @@ static void end_compressed_bio_write(struct bio *bio)
/* if there are more bios still pending for this compressed /* if there are more bios still pending for this compressed
* extent, just exit * extent, just exit
*/ */
if (!atomic_dec_and_test(&cb->pending_bios)) if (!refcount_dec_and_test(&cb->pending_bios))
goto out; goto out;
/* ok, we're the last bio for this extent, step one is to /* ok, we're the last bio for this extent, step one is to
...@@ -342,7 +342,7 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start, ...@@ -342,7 +342,7 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start,
cb = kmalloc(compressed_bio_size(fs_info, compressed_len), GFP_NOFS); cb = kmalloc(compressed_bio_size(fs_info, compressed_len), GFP_NOFS);
if (!cb) if (!cb)
return -ENOMEM; return -ENOMEM;
atomic_set(&cb->pending_bios, 0); refcount_set(&cb->pending_bios, 0);
cb->errors = 0; cb->errors = 0;
cb->inode = inode; cb->inode = inode;
cb->start = start; cb->start = start;
...@@ -363,7 +363,7 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start, ...@@ -363,7 +363,7 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start,
bio_set_op_attrs(bio, REQ_OP_WRITE, 0); bio_set_op_attrs(bio, REQ_OP_WRITE, 0);
bio->bi_private = cb; bio->bi_private = cb;
bio->bi_end_io = end_compressed_bio_write; bio->bi_end_io = end_compressed_bio_write;
atomic_inc(&cb->pending_bios); refcount_set(&cb->pending_bios, 1);
/* create and submit bios for the compressed pages */ /* create and submit bios for the compressed pages */
bytes_left = compressed_len; bytes_left = compressed_len;
...@@ -388,7 +388,7 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start, ...@@ -388,7 +388,7 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start,
* we inc the count. Otherwise, the cb might get * we inc the count. Otherwise, the cb might get
* freed before we're done setting it up * freed before we're done setting it up
*/ */
atomic_inc(&cb->pending_bios); refcount_inc(&cb->pending_bios);
ret = btrfs_bio_wq_end_io(fs_info, bio, ret = btrfs_bio_wq_end_io(fs_info, bio,
BTRFS_WQ_ENDIO_DATA); BTRFS_WQ_ENDIO_DATA);
BUG_ON(ret); /* -ENOMEM */ BUG_ON(ret); /* -ENOMEM */
...@@ -607,7 +607,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio, ...@@ -607,7 +607,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
if (!cb) if (!cb)
goto out; goto out;
atomic_set(&cb->pending_bios, 0); refcount_set(&cb->pending_bios, 0);
cb->errors = 0; cb->errors = 0;
cb->inode = inode; cb->inode = inode;
cb->mirror_num = mirror_num; cb->mirror_num = mirror_num;
...@@ -656,7 +656,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio, ...@@ -656,7 +656,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
bio_set_op_attrs (comp_bio, REQ_OP_READ, 0); bio_set_op_attrs (comp_bio, REQ_OP_READ, 0);
comp_bio->bi_private = cb; comp_bio->bi_private = cb;
comp_bio->bi_end_io = end_compressed_bio_read; comp_bio->bi_end_io = end_compressed_bio_read;
atomic_inc(&cb->pending_bios); refcount_set(&cb->pending_bios, 1);
for (pg_index = 0; pg_index < nr_pages; pg_index++) { for (pg_index = 0; pg_index < nr_pages; pg_index++) {
page = cb->compressed_pages[pg_index]; page = cb->compressed_pages[pg_index];
...@@ -685,7 +685,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio, ...@@ -685,7 +685,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
* we inc the count. Otherwise, the cb might get * we inc the count. Otherwise, the cb might get
* freed before we're done setting it up * freed before we're done setting it up
*/ */
atomic_inc(&cb->pending_bios); refcount_inc(&cb->pending_bios);
if (!(BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)) { if (!(BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)) {
ret = btrfs_lookup_bio_sums(inode, comp_bio, ret = btrfs_lookup_bio_sums(inode, comp_bio,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment