On Wed, Jul 1, 2020 at 9:24 PM Josef Bacik <josef@xxxxxxxxxxxxxx> wrote:
>
> I was experimenting with some new allocator changes and I noticed that I
> was getting a UAF with the block groups. In order to help figure this
> out I converted the block group to use the refcount_t infrastructure.
> This is a generally good idea anyway, so kill the atomic and use
> refcount_t so we can get the benefit of loud complaints when refcounting
> goes wrong.
>
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Reviewed-by: Filipe Manana <fdmanana@xxxxxxxx>
Looks good and the patch compiles and works just fine here on the
latest misc-next.
Thanks.
> ---
> fs/btrfs/block-group.c | 8 ++++----
> fs/btrfs/block-group.h | 2 +-
> 2 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
> index 09b796a081dd..7c0075413b08 100644
> --- a/fs/btrfs/block-group.c
> +++ b/fs/btrfs/block-group.c
> @@ -118,12 +118,12 @@ u64 btrfs_get_alloc_profile(struct btrfs_fs_info *fs_info, u64 orig_flags)
>
> void btrfs_get_block_group(struct btrfs_block_group *cache)
> {
> - atomic_inc(&cache->count);
> + refcount_inc(&cache->count);
> }
>
> void btrfs_put_block_group(struct btrfs_block_group *cache)
> {
> - if (atomic_dec_and_test(&cache->count)) {
> + if (refcount_dec_and_test(&cache->count)) {
> WARN_ON(cache->pinned > 0);
> WARN_ON(cache->reserved > 0);
>
> @@ -1805,7 +1805,7 @@ static struct btrfs_block_group *btrfs_create_block_group_cache(
>
> cache->discard_index = BTRFS_DISCARD_INDEX_UNUSED;
>
> - atomic_set(&cache->count, 1);
> + refcount_set(&cache->count, 1);
> spin_lock_init(&cache->lock);
> init_rwsem(&cache->data_rwsem);
> INIT_LIST_HEAD(&cache->list);
> @@ -3427,7 +3427,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
> ASSERT(list_empty(&block_group->dirty_list));
> ASSERT(list_empty(&block_group->io_list));
> ASSERT(list_empty(&block_group->bg_list));
> - ASSERT(atomic_read(&block_group->count) == 1);
> + ASSERT(refcount_read(&block_group->count) == 1);
> btrfs_put_block_group(block_group);
>
> spin_lock(&info->block_group_cache_lock);
> diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h
> index b6ee70a039c7..705e48050163 100644
> --- a/fs/btrfs/block-group.h
> +++ b/fs/btrfs/block-group.h
> @@ -115,7 +115,7 @@ struct btrfs_block_group {
> struct list_head list;
>
> /* Usage count */
> - atomic_t count;
> + refcount_t count;
>
> /*
> * List of struct btrfs_free_clusters for this block group.
> --
> 2.24.1
>
--
Filipe David Manana,
“Whether you think you can, or you think you can't — you're right.”
