[PATCH 1/6] block: convert bio.__bi_cnt from atomic_t to refcount_t

2017-10-20 Thread Elena Reshetova
com> Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> --- block/bio.c | 6 +++--- fs/btrfs/volumes.c| 2 +- include/linux/bio.h | 4 ++-- include/linux/blk_types.h | 3 ++- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/block/bio.c b/b

[PATCH 0/6] v4 block refcount conversion patches

2017-10-20 Thread Elena Reshetova
vulnerabilities. The patches are fully independent and can be cherry-picked separately. If there are no objections to the patches, please merge them via respective trees. Elena Reshetova (6): block: convert bio.__bi_cnt from atomic_t to refcount_t block: convert blk_queue_tag.refcnt from

[PATCH 3/6] block: convert blkcg_gq.refcnt from atomic_t to refcount_t

2017-10-20 Thread Elena Reshetova
com> Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> --- block/blk-cgroup.c | 2 +- include/linux/blk-cgroup.h | 11 ++- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index d3f56ba..1e7cedc 100644 --- a/

[PATCH 2/6] block: convert blk_queue_tag.refcnt from atomic_t to refcount_t

2017-10-20 Thread Elena Reshetova
ail.com> Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> --- block/blk-tag.c| 8 include/linux/blkdev.h | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/block/blk-tag.c b/block/blk-tag.c index e1a9c15..a7263e3 100644 --- a/block/blk-tag

[PATCH 6/6] drivers, block: convert xen_blkif.refcnt from atomic_t to refcount_t

2017-10-20 Thread Elena Reshetova
com> Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> --- drivers/block/xen-blkback/common.h | 7 --- drivers/block/xen-blkback/xenbus.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkbac

[PATCH 4/6] block: convert io_context.active_ref from atomic_t to refcount_t

2017-10-20 Thread Elena Reshetova
ail.com> Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> --- block/bfq-iosched.c | 2 +- block/blk-ioc.c | 4 ++-- block/cfq-iosched.c | 4 ++-- include/linux/iocontext.h | 7 --- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/block/b

[PATCH 5/6] block: convert bsg_device.ref_count from atomic_t to refcount_t

2017-10-20 Thread Elena Reshetova
ail.com> Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> --- block/bsg.c | 9 + 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/block/bsg.c b/block/bsg.c index ee1335c..6c98422 100644 --- a/block/bsg.c +++ b/block/bsg.c @@ -21,6 +21,7 @@ #include #inclu

[PATCH 3/5] block: convert blkcg_gq.refcnt from atomic_t to refcount_t

2017-06-27 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 4/5] block: convert io_context.active_ref from atomic_t to refcount_t

2017-06-27 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 5/5] block: convert bsg_device.ref_count from atomic_t to refcount_t

2017-06-27 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 0/5] v3 block subsystem refcounter conversions

2017-06-27 Thread Elena Reshetova
/refcount.h). By doing this we prevent intentional or accidental underflows or overflows that can lead to use-after-free vulnerabilities. Elena Reshetova (5): block: convert bio.__bi_cnt from atomic_t to refcount_t block: convert blk_queue_tag.refcnt from atomic_t to refcount_t block: convert

[PATCH 1/5] block: convert bio.__bi_cnt from atomic_t to refcount_t

2017-06-27 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 2/5] block: convert blk_queue_tag.refcnt from atomic_t to refcount_t

2017-06-27 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 2/5] block: convert blk_queue_tag.refcnt from atomic_t to refcount_t

2017-04-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 0/5] v2: block subsystem refcounter conversions

2017-04-20 Thread Elena Reshetova
this we prevent intentional or accidental underflows or overflows that can lead to use-after-free vulnerabilities. Elena Reshetova (5): block: convert bio.__bi_cnt from atomic_t to refcount_t block: convert blk_queue_tag.refcnt from atomic_t to refcount_t block: convert blkcg_gq.refcnt from

[PATCH 3/5] block: convert blkcg_gq.refcnt from atomic_t to refcount_t

2017-04-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 1/5] block: convert bio.__bi_cnt from atomic_t to refcount_t

2017-04-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 4/5] block: convert io_context.active_ref from atomic_t to refcount_t

2017-04-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 5/5] block: convert bsg_device.ref_count from atomic_t to refcount_t

2017-04-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 11/17] fs, btrfs: convert compressed_bio.pending_bios from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 06/17] fs, btrfs: convert btrfs_delayed_ref_node.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 07/17] fs, btrfs: convert btrfs_delayed_node.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 02/17] fs, btrfs: convert btrfs_transaction.use_count from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 15/17] fs, btrfs: convert scrub_parity.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 08/17] fs, btrfs: convert btrfs_delayed_item.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 10/17] fs, btrfs: convert extent_state.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 09/17] fs, btrfs: convert btrfs_root.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 16/17] fs, btrfs: convert scrub_ctx.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 17/17] fs, btrfs: convert btrfs_raid_bio.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 00/17] fs, btrfs refcount conversions

2017-03-03 Thread Elena Reshetova
looking at the code on what causes the failure, but could not figure it out. It doesn't seem to be related to any refcount changes at least IMO. The above test failures are hard for me to understand and interpreted, but they don't seem to relate to refcount conversions. Elena Reshetova (17): fs

[PATCH 13/17] fs, btrfs: convert scrub_page.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 12/17] fs, btrfs: convert scrub_recover.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 14/17] fs, btrfs: convert scrub_block.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 01/17] fs, btrfs: convert btrfs_bio.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 04/17] fs, btrfs: convert btrfs_ordered_extent.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 03/17] fs, btrfs: convert extent_map.refs from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 05/17] fs, btrfs: convert btrfs_caching_control.count from atomic_t to refcount_t

2017-03-03 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 0/5] block subsystem refcounter conversions

2017-02-20 Thread Elena Reshetova
vulnerabilities. The below patches are fully independent and can be cherry-picked separately. Since we convert all kernel subsystems in the same fashion, resulting in about 300 patches, we have to group them for sending at least in some fashion to be manageable. Please excuse the long cc list. Elena

[PATCH 1/5] block: convert bio.__bi_cnt from atomic_t to refcount_t

2017-02-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 2/5] block: convert blk_queue_tag.refcnt from atomic_t to refcount_t

2017-02-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 4/5] block: convert io_context.active_ref from atomic_t to refcount_t

2017-02-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 3/5] block: convert blkcg_gq.refcnt from atomic_t to refcount_t

2017-02-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign

[PATCH 5/5] block: convert bsg_device.ref_count from atomic_t to refcount_t

2017-02-20 Thread Elena Reshetova
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshet...@intel.com> Sign