From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751374AbdAaQzr (ORCPT ); Tue, 31 Jan 2017 11:55:47 -0500 Received: from mail-pf0-f196.google.com ([209.85.192.196]:36258 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750883AbdAaQzk (ORCPT ); Tue, 31 Jan 2017 11:55:40 -0500 Date: Tue, 31 Jan 2017 11:55:37 -0500 From: Tejun Heo To: Linus Torvalds Cc: linux-kernel@vger.kernel.org, dougmill@linux.vnet.ibm.com Subject: [GIT PULL] percpu fix for v4.10-rc6 Message-ID: <20170131165537.GC23970@htj.duckdns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.7.1 (2016-10-04) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, Douglas found and fixed a ref leak bug in percpu_ref_tryget[_live](). The bug is caused by storing the return value of atomic_long_inc_not_zero() into an int temp variable before returning it as a bool. The interim cast to int loses the upper bits and can lead to false negatives. As percpu_ref uses a high bit to mark a draining counter, this can happen relatively easily. Fixed by using bool for the temp variable. Thanks. The following changes since commit 1b1bc42c1692e9b62756323c675a44cb1a1f9dbd: Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2017-01-27 12:54:16 -0800) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu.git for-4.10-fixes for you to fetch changes up to 966d2b04e070bc040319aaebfec09e0144dc3341: percpu-refcount: fix reference leak during percpu-atomic transition (2017-01-28 07:49:42 -0500) ---------------------------------------------------------------- Douglas Miller (1): percpu-refcount: fix reference leak during percpu-atomic transition include/linux/percpu-refcount.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h index 1c7eec0..3a481a4 100644 --- a/include/linux/percpu-refcount.h +++ b/include/linux/percpu-refcount.h @@ -204,7 +204,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref) static inline bool percpu_ref_tryget(struct percpu_ref *ref) { unsigned long __percpu *percpu_count; - int ret; + bool ret; rcu_read_lock_sched(); @@ -238,7 +238,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref) static inline bool percpu_ref_tryget_live(struct percpu_ref *ref) { unsigned long __percpu *percpu_count; - int ret = false; + bool ret = false; rcu_read_lock_sched(); -- tejun