btrfs: convert btrfs_bio.refs from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 02bbc4c8c755034adde891ec2006ebaec05996dd..0f670604716757117fa38e6bbf5ecd1f8054bb00 100644 (file)
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -5301,22 +5301,22 @@ static struct btrfs_bio *alloc_btrfs_bio(int total_stripes, int real_stripes)
                GFP_NOFS|__GFP_NOFAIL);
 
        atomic_set(&bbio->error, 0);
-       atomic_set(&bbio->refs, 1);
+       refcount_set(&bbio->refs, 1);
 
        return bbio;
 }
 
 void btrfs_get_bbio(struct btrfs_bio *bbio)
 {
-       WARN_ON(!atomic_read(&bbio->refs));
-       atomic_inc(&bbio->refs);
+       WARN_ON(!refcount_read(&bbio->refs));
+       refcount_inc(&bbio->refs);
 }
 
 void btrfs_put_bbio(struct btrfs_bio *bbio)
 {
        if (!bbio)
                return;
-       if (atomic_dec_and_test(&bbio->refs))
+       if (refcount_dec_and_test(&bbio->refs))
                kfree(bbio);
 }
 

diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 59be81206dd7b949683ad95c80fa561c022ad812..ac0bf7d0df60e8f2c49aff3929c88253864b7e37 100644 (file)
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -298,7 +298,7 @@ struct btrfs_bio;
 typedef void (btrfs_bio_end_io_t) (struct btrfs_bio *bio, int err);
 
 struct btrfs_bio {
-       atomic_t refs;
+       refcount_t refs;
        atomic_t stripes_pending;
        struct btrfs_fs_info *fs_info;
        u64 map_type; /* get from map_lookup->type */