From: Kees Cook <keescook@chromium.org>
To: Shuah Khan <skhan@linuxfoundation.org>
Cc: corbet@lwn.net, gregkh@linuxfoundation.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3 01/11] counters: Introduce counter_atomic* counters
Date: Fri, 9 Oct 2020 11:00:54 -0700 [thread overview]
Message-ID: <202010091100.9327D918@keescook> (raw)
In-Reply-To: <baede266cc0c69da61142b467ff386c6b31a70b7.1602209970.git.skhan@linuxfoundation.org>
On Fri, Oct 09, 2020 at 09:55:56AM -0600, Shuah Khan wrote:
> Introduce Simple atomic counters.
>
> There are a number of atomic_t usages in the kernel where atomic_t api
> is used strictly for counting and not for managing object lifetime. In
> some cases, atomic_t might not even be needed.
>
> The purpose of these counters is to clearly differentiate atomic_t
> counters from atomic_t usages that guard object lifetimes, hence prone
> to overflow and underflow errors. It allows tools that scan for underflow
> and overflow on atomic_t usages to detect overflow and underflows to scan
> just the cases that are prone to errors.
>
> Simple atomic counters api provides interfaces for simple atomic counters
> that just count, and don't guard resource lifetimes. The interfaces are
> built on top of atomic_t api, providing a smaller subset of atomic_t
> interfaces necessary to support simple counters.
>
> Counter wraps around to INT_MIN when it overflows and should not be used
> to guard resource lifetimes, device usage and open counts that control
> state changes, and pm states. Overflowing to INT_MIN is consistent with
> the atomic_t api, which it is built on top of.
>
> Using counter_atomic* to guard lifetimes could lead to use-after free
> when it overflows and undefined behavior when used to manage state
> changes and device usage/open states.
>
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
next prev parent reply other threads:[~2020-10-09 18:00 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-09 15:55 [PATCH v3 00/11] Introduce Simple atomic counters Shuah Khan
2020-10-09 15:55 ` [PATCH v3 01/11] counters: Introduce counter_atomic* counters Shuah Khan
2020-10-09 18:00 ` Kees Cook [this message]
2020-10-09 19:49 ` Peter Zijlstra
2020-10-13 11:27 ` Mauro Carvalho Chehab
2020-10-15 1:11 ` Shuah Khan
2020-10-09 15:55 ` [PATCH v3 02/11] selftests:lib:test_counters: add new test for counters Shuah Khan
2020-10-09 18:02 ` Kees Cook
2020-10-09 15:55 ` [PATCH v3 03/11] drivers/base: convert deferred_trigger_count and probe_count to counter_atomic32 Shuah Khan
2020-10-09 15:55 ` [PATCH v3 04/11] drivers/base/devcoredump: convert devcd_count " Shuah Khan
2020-10-09 18:02 ` Kees Cook
2020-10-09 19:51 ` Peter Zijlstra
2020-10-09 15:56 ` [PATCH v3 05/11] drivers/acpi: convert seqno counter_atomic32 Shuah Khan
2020-10-09 15:56 ` [PATCH v3 06/11] drivers/acpi/apei: " Shuah Khan
2020-10-09 15:56 ` [PATCH v3 07/11] drivers/android/binder: convert stats, transaction_log to counter_atomic32 Shuah Khan
2020-10-09 15:56 ` [PATCH v3 08/11] drivers/base/test/test_async_driver_probe: convert to use counter_atomic32 Shuah Khan
2020-10-09 15:56 ` [PATCH v3 09/11] drivers/char/ipmi: convert stats " Shuah Khan
2020-10-09 15:56 ` [PATCH v3 10/11] drivers/misc/vmw_vmci: convert num guest devices counter to counter_atomic32 Shuah Khan
2020-10-09 15:56 ` [PATCH v3 11/11] drivers/edac: convert pci counters " Shuah Khan
2020-10-09 18:03 ` [PATCH v3 00/11] Introduce Simple atomic counters Kees Cook
2020-10-09 19:02 ` Shuah Khan
2020-10-09 19:37 ` Peter Zijlstra
2020-10-09 20:45 ` Kees Cook
2020-10-10 11:09 ` Peter Zijlstra
2020-10-14 2:12 ` Shuah Khan
2020-10-14 9:17 ` Peter Zijlstra
2020-10-14 23:31 ` Kees Cook
2020-10-16 10:53 ` Peter Zijlstra
2020-10-16 22:51 ` Kees Cook
2020-11-10 18:49 ` Dan Carpenter
2020-10-16 21:56 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202010091100.9327D918@keescook \
--to=keescook@chromium.org \
--cc=corbet@lwn.net \
--cc=gregkh@linuxfoundation.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=skhan@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.