Commit cc9e5a84 authored by Weihang Li's avatar Weihang Li Committed by Jason Gunthorpe
Browse files

RDMA/hns: Use refcount_t instead of atomic_t for CQ reference counting 

The refcount_t API will WARN on underflow and overflow of a reference
counter, and avoid use-after-free risks.

Link: https://lore.kernel.org/r/1622194663-2383-9-git-send-email-liweihang@huawei.com


Signed-off-by: default avatarWeihang Li <liweihang@huawei.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 58d33b4f

drivers/infiniband/hw/hns/hns_roce_cq.c

+4 −4
Original line number Diff line number Diff line
@@ -154,7 +154,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
	hr_cq->cons_index = 0;

	hr_cq->arm_sn = 1;



	atomic_set(&hr_cq->refcount, 1);

	refcount_set(&hr_cq->refcount, 1);

	init_completion(&hr_cq->free);



	return 0;
@@ -188,7 +188,7 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
	synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq);



	/* wait for all interrupt processed */

	if (atomic_dec_and_test(&hr_cq->refcount))

	if (refcount_dec_and_test(&hr_cq->refcount))

		complete(&hr_cq->free);

	wait_for_completion(&hr_cq->free);
@@ -480,7 +480,7 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) 
		return;

	}



	atomic_inc(&hr_cq->refcount);

	refcount_inc(&hr_cq->refcount);



	ibcq = &hr_cq->ib_cq;

	if (ibcq->event_handler) {
@@ -490,7 +490,7 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) 
		ibcq->event_handler(&event, ibcq->cq_context);

	}



	if (atomic_dec_and_test(&hr_cq->refcount))

	if (refcount_dec_and_test(&hr_cq->refcount))

		complete(&hr_cq->free);

}

drivers/infiniband/hw/hns/hns_roce_device.h

+1 −1
Original line number Diff line number Diff line
@@ -444,7 +444,7 @@ struct hns_roce_cq { 
	int				cqe_size;

	unsigned long			cqn;

	u32				vector;

	atomic_t			refcount;

	refcount_t			refcount;

	struct completion		free;

	struct list_head		sq_list; /* all qps on this send cq */

	struct list_head		rq_list; /* all qps on this recv cq */