Skip to content

Commit

Permalink
RDMA/hns: Use refcount_t instead of atomic_t for SRQ reference counting
Browse files Browse the repository at this point in the history
The refcount_t API will WARN on underflow and overflow of a reference
counter, and avoid use-after-free risks.

Link: https://lore.kernel.org/r/1622194663-2383-10-git-send-email-liweihang@huawei.com
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
  • Loading branch information
Weihang Li authored and Jason Gunthorpe committed Jun 8, 2021
1 parent cc9e5a8 commit 33649cd
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 5 deletions.
2 changes: 1 addition & 1 deletion drivers/infiniband/hw/hns/hns_roce_device.h
Original file line number Diff line number Diff line change
Expand Up @@ -471,7 +471,7 @@ struct hns_roce_srq {
u32 xrcdn;
void __iomem *db_reg;

atomic_t refcount;
refcount_t refcount;
struct completion free;

struct hns_roce_mtr buf_mtr;
Expand Down
8 changes: 4 additions & 4 deletions drivers/infiniband/hw/hns/hns_roce_srq.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ void hns_roce_srq_event(struct hns_roce_dev *hr_dev, u32 srqn, int event_type)
xa_lock(&srq_table->xa);
srq = xa_load(&srq_table->xa, srqn & (hr_dev->caps.num_srqs - 1));
if (srq)
atomic_inc(&srq->refcount);
refcount_inc(&srq->refcount);
xa_unlock(&srq_table->xa);

if (!srq) {
Expand All @@ -27,7 +27,7 @@ void hns_roce_srq_event(struct hns_roce_dev *hr_dev, u32 srqn, int event_type)

srq->event(srq, event_type);

if (atomic_dec_and_test(&srq->refcount))
if (refcount_dec_and_test(&srq->refcount))
complete(&srq->free);
}

Expand Down Expand Up @@ -149,7 +149,7 @@ static void free_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq)

xa_erase(&srq_table->xa, srq->srqn);

if (atomic_dec_and_test(&srq->refcount))
if (refcount_dec_and_test(&srq->refcount))
complete(&srq->free);
wait_for_completion(&srq->free);

Expand Down Expand Up @@ -417,7 +417,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,

srq->db_reg = hr_dev->reg_base + SRQ_DB_REG;
srq->event = hns_roce_ib_srq_event;
atomic_set(&srq->refcount, 1);
refcount_set(&srq->refcount, 1);
init_completion(&srq->free);

return 0;
Expand Down

0 comments on commit 33649cd

Please sign in to comment.