On Tue, Oct 06, 2020 at 02:44:39PM -0600, Shuah Khan wrote:
> counter_atomic* is introduced to be used when a variable is used as
> a simple counter and doesn't guard object lifetimes. This clearly
> differentiates atomic_t usages that guard object lifetimes.
>
> counter_atomic* variables will wrap around to 0 when it overflows and
> should not be used to guard resource lifetimes, device usage and
> open counts that control state changes, and pm states.
>
> atomic_t variables used to count errors, warns, keep track of timeout,
> and async completion are counters.
>
> Unsure overflow is a concern for timeout and async completion, and there
> are no checks for overflow to hold them to upper bounds. Overflow and
> wrap around doesn't impact errors, and warns.
>
> Convert them to use counter_atomic32.
>
> This conversion doesn't change the overflow wrap around behavior.
>
> Reviewed-by: Greg Kroah-Hartman <[email protected]>
> Signed-off-by: Shuah Khan <[email protected]>
> ---
> drivers/base/test/test_async_driver_probe.c | 23 ++++++++++++---------
> 1 file changed, 13 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/base/test/test_async_driver_probe.c
> b/drivers/base/test/test_async_driver_probe.c
> index 3bb7beb127a9..e969c1b09426 100644
> --- a/drivers/base/test/test_async_driver_probe.c
> +++ b/drivers/base/test/test_async_driver_probe.c
> @@ -14,11 +14,12 @@
> #include <linux/numa.h>
> #include <linux/nodemask.h>
> #include <linux/topology.h>
> +#include <linux/counters.h>
>
> #define TEST_PROBE_DELAY (5 * 1000) /* 5 sec */
> #define TEST_PROBE_THRESHOLD (TEST_PROBE_DELAY / 2)
>
> -static atomic_t warnings, errors, timeout, async_completed;
> +static struct counter_atomic32 warnings, errors, timeout, async_completed;
While it's currently harmless, this should likely be using
COUNTER_ATOMIC_INIT(0)s...
>
> static int test_probe(struct platform_device *pdev)
> {
> @@ -29,9 +30,9 @@ static int test_probe(struct platform_device *pdev)
> * have then report it as an error, otherwise we wil sleep for the
> * required amount of time and then report completion.
> */
> - if (atomic_read(&timeout)) {
> + if (counter_atomic32_read(&timeout)) {
> dev_err(dev, "async probe took too long\n");
> - atomic_inc(&errors);
> + counter_atomic32_inc(&errors);
> } else {
> dev_dbg(&pdev->dev, "sleeping for %d msecs in probe\n",
> TEST_PROBE_DELAY);
> @@ -48,10 +49,10 @@ static int test_probe(struct platform_device *pdev)
> dev_to_node(dev) != numa_node_id()) {
> dev_warn(dev, "NUMA node mismatch %d != %d\n",
> dev_to_node(dev), numa_node_id());
> - atomic_inc(&warnings);
> + counter_atomic32_inc(&warnings);
> }
>
> - atomic_inc(&async_completed);
> + counter_atomic32_inc(&async_completed);
> }
>
> return 0;
> @@ -244,11 +245,12 @@ static int __init test_async_probe_init(void)
> * Otherwise if they completed without errors or warnings then
> * report successful completion.
> */
> - if (atomic_read(&async_completed) != async_id) {
> + if (counter_atomic32_read(&async_completed) != async_id) {
> pr_err("async events still pending, forcing timeout\n");
> - atomic_inc(&timeout);
> + counter_atomic32_inc(&timeout);
> err = -ETIMEDOUT;
> - } else if (!atomic_read(&errors) && !atomic_read(&warnings)) {
> + } else if (!counter_atomic32_read(&errors) &&
> + !counter_atomic32_read(&warnings)) {
> pr_info("completed successfully\n");
> return 0;
> }
> @@ -271,12 +273,13 @@ static int __init test_async_probe_init(void)
> * errors or warnings being reported by the probe routine.
> */
> if (err)
> - atomic_inc(&errors);
> + counter_atomic32_inc(&errors);
> else
> err = -EINVAL;
>
> pr_err("Test failed with %d errors and %d warnings\n",
> - atomic_read(&errors), atomic_read(&warnings));
> + counter_atomic32_read(&errors),
> + counter_atomic32_read(&warnings));
>
> return err;
> }
> --
> 2.25.1
>
But yeah, this is otherwise just reporting and simple one-time synchronization.
Reviewed-by: Kees Cook <[email protected]>
--
Kees Cook
