Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Revert "mm/secretmem: use refcount_t instead of atomic_t"
This reverts commit 110860541f443f950c1274f217a1a3e298670a33.
Converting the "secretmem_users" counter to a refcount is incorrect,
because a refcount is special in zero and can't just be incremented (but
a count of users is not, and "no users" is actually perfectly valid and
not a sign of a free'd resource).
Reported-by: syzbot+75639e6a0331cd61d3e2@syzkaller.appspotmail.com
Cc: Jordy Zomer <jordy@pwning.systems>
Cc: Kees Cook <keescook@chromium.org>,
Cc: Jordy Zomer <jordy@jordyzomer.github.io>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+4
-5
+4
-5
mm/secretmem.c
+4
-5
mm/secretmem.c
···
18
18
#include <linux/secretmem.h>
19
19
#include <linux/set_memory.h>
20
20
#include <linux/sched/signal.h>
21
-
#include <linux/refcount.h>
22
21
23
22
#include <uapi/linux/magic.h>
24
23
···
40
41
MODULE_PARM_DESC(secretmem_enable,
41
42
"Enable secretmem and memfd_secret(2) system call");
42
43
43
-
static refcount_t secretmem_users;
44
+
static atomic_t secretmem_users;
44
45
45
46
bool secretmem_active(void)
46
47
{
47
-
return !!refcount_read(&secretmem_users);
48
+
return !!atomic_read(&secretmem_users);
48
49
}
49
50
50
51
static vm_fault_t secretmem_fault(struct vm_fault *vmf)
···
103
104
104
105
static int secretmem_release(struct inode *inode, struct file *file)
105
106
{
106
-
refcount_dec(&secretmem_users);
107
+
atomic_dec(&secretmem_users);
107
108
return 0;
108
109
}
109
110
···
217
218
file->f_flags |= O_LARGEFILE;
218
219
219
220
fd_install(fd, file);
220
-
refcount_inc(&secretmem_users);
221
+
atomic_inc(&secretmem_users);
221
222
return fd;
222
223
223
224
err_put_fd: