Commit 33649cd3 authored by Weihang Li's avatar Weihang Li Committed by Jason Gunthorpe
Browse files

RDMA/hns: Use refcount_t instead of atomic_t for SRQ reference counting 

The refcount_t API will WARN on underflow and overflow of a reference
counter, and avoid use-after-free risks.

Link: https://lore.kernel.org/r/1622194663-2383-10-git-send-email-liweihang@huawei.com


Signed-off-by: default avatarWeihang Li <liweihang@huawei.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent cc9e5a84

drivers/infiniband/hw/hns/hns_roce_device.h

+1 −1
Original line number Diff line number Diff line
@@ -471,7 +471,7 @@ struct hns_roce_srq { 
	u32			xrcdn;

	void __iomem		*db_reg;



	atomic_t		refcount;

	refcount_t		refcount;

	struct completion	free;



	struct hns_roce_mtr	buf_mtr;

drivers/infiniband/hw/hns/hns_roce_srq.c

+4 −4
Original line number Diff line number Diff line
@@ -17,7 +17,7 @@ void hns_roce_srq_event(struct hns_roce_dev *hr_dev, u32 srqn, int event_type) 
	xa_lock(&srq_table->xa);

	srq = xa_load(&srq_table->xa, srqn & (hr_dev->caps.num_srqs - 1));

	if (srq)

		atomic_inc(&srq->refcount);

		refcount_inc(&srq->refcount);

	xa_unlock(&srq_table->xa);



	if (!srq) {
@@ -27,7 +27,7 @@ void hns_roce_srq_event(struct hns_roce_dev *hr_dev, u32 srqn, int event_type) 


	srq->event(srq, event_type);



	if (atomic_dec_and_test(&srq->refcount))

	if (refcount_dec_and_test(&srq->refcount))

		complete(&srq->free);

}
@@ -149,7 +149,7 @@ static void free_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) 


	xa_erase(&srq_table->xa, srq->srqn);



	if (atomic_dec_and_test(&srq->refcount))

	if (refcount_dec_and_test(&srq->refcount))

		complete(&srq->free);

	wait_for_completion(&srq->free);
@@ -417,7 +417,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq, 


	srq->db_reg = hr_dev->reg_base + SRQ_DB_REG;

	srq->event = hns_roce_ib_srq_event;

	atomic_set(&srq->refcount, 1);

	refcount_set(&srq->refcount, 1);

	init_completion(&srq->free);



	return 0;