On Wed, Jul 01, 2020 at 04:22:18PM -0400, Josef Bacik wrote:
> I was experimenting with some new allocator changes and I noticed that I
> was getting a UAF with the block groups. In order to help figure this
> out I converted the block group to use the refcount_t infrastructure.
> This is a generally good idea anyway, so kill the atomic and use
> refcount_t so we can get the benefit of loud complaints when refcounting
> goes wrong.
I don't mind adding some background or motivation of the patch but the
technical part and explanation should be still there and after reading
this paragraph I'm still mssing it.
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
> fs/btrfs/block-group.c | 8 ++++----
> fs/btrfs/block-group.h | 2 +-
> 2 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
> index 09b796a081dd..7c0075413b08 100644
> --- a/fs/btrfs/block-group.c
> +++ b/fs/btrfs/block-group.c
> @@ -118,12 +118,12 @@ u64 btrfs_get_alloc_profile(struct btrfs_fs_info *fs_info, u64 orig_flags)
>
> void btrfs_get_block_group(struct btrfs_block_group *cache)
> {
> - atomic_inc(&cache->count);
> + refcount_inc(&cache->count);
> }
>
> void btrfs_put_block_group(struct btrfs_block_group *cache)
> {
> - if (atomic_dec_and_test(&cache->count)) {
> + if (refcount_dec_and_test(&cache->count)) {
> WARN_ON(cache->pinned > 0);
> WARN_ON(cache->reserved > 0);
>
> @@ -1805,7 +1805,7 @@ static struct btrfs_block_group *btrfs_create_block_group_cache(
>
> cache->discard_index = BTRFS_DISCARD_INDEX_UNUSED;
>
> - atomic_set(&cache->count, 1);
> + refcount_set(&cache->count, 1);
> spin_lock_init(&cache->lock);
> init_rwsem(&cache->data_rwsem);
> INIT_LIST_HEAD(&cache->list);
> @@ -3427,7 +3427,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
> ASSERT(list_empty(&block_group->dirty_list));
> ASSERT(list_empty(&block_group->io_list));
> ASSERT(list_empty(&block_group->bg_list));
> - ASSERT(atomic_read(&block_group->count) == 1);
> + ASSERT(refcount_read(&block_group->count) == 1);
> btrfs_put_block_group(block_group);
>
> spin_lock(&info->block_group_cache_lock);
> diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h
> index b6ee70a039c7..705e48050163 100644
> --- a/fs/btrfs/block-group.h
> +++ b/fs/btrfs/block-group.h
> @@ -115,7 +115,7 @@ struct btrfs_block_group {
> struct list_head list;
>
> /* Usage count */
> - atomic_t count;
> + refcount_t count;
Originally the comment says 'usage', which is a bit different from
refcounts. The atomics will allow 1->0 and 0->1, which might be valid
pattern and reflects the 'usage counter' semantics. The refcounts catch
the 0->1 increment as bug and complain. This is what we want and that's
why you switch that.
So I suggest to drop the comment and rename it to 'refs' that we use
for refcounts elsewhere.
