Commit 58d33b4f authored by Weihang Li's avatar Weihang Li Committed by Jason Gunthorpe
Browse files

RDMA/core: Use refcount_t instead of atomic_t on refcount of mcast_port 

The refcount_t API will WARN on underflow and overflow of a reference
counter, and avoid use-after-free risks.

Link: https://lore.kernel.org/r/1622194663-2383-6-git-send-email-liweihang@huawei.com


Signed-off-by: default avatarWeihang Li <liweihang@huawei.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent cd74db6c

drivers/infiniband/core/multicast.c

+4 −4
Original line number Diff line number Diff line
@@ -61,7 +61,7 @@ struct mcast_port { 
	struct mcast_device	*dev;

	spinlock_t		lock;

	struct rb_root		table;

	atomic_t		refcount;

	refcount_t		refcount;

	struct completion	comp;

	u32			port_num;

};
@@ -178,7 +178,7 @@ static struct mcast_group *mcast_insert(struct mcast_port *port, 


static void deref_port(struct mcast_port *port)

{

	if (atomic_dec_and_test(&port->refcount))

	if (refcount_dec_and_test(&port->refcount))

		complete(&port->comp);

}
@@ -589,7 +589,7 @@ static struct mcast_group *acquire_group(struct mcast_port *port, 
		kfree(group);

		group = cur_group;

	} else

		atomic_inc(&port->refcount);

		refcount_inc(&port->refcount);

found:

	atomic_inc(&group->refcount);

	spin_unlock_irqrestore(&port->lock, flags);
@@ -840,7 +840,7 @@ static int mcast_add_one(struct ib_device *device) 
		spin_lock_init(&port->lock);

		port->table = RB_ROOT;

		init_completion(&port->comp);

		atomic_set(&port->refcount, 1);

		refcount_set(&port->refcount, 1);

		++count;

	}