The patch titled
Subject: mm/mempolicy: convert from atomic_t to refcount_t on mempolicy->refcnt
has been removed from the -mm tree. Its filename was
mm-mempolicy-convert-from-atomic_t-to-refcount_t-on-mempolicy-refcnt.patch
This patch was dropped because it was nacked
------------------------------------------------------
From: Xiyu Yang <xiyuyang19@xxxxxxxxxxxx>
Subject: mm/mempolicy: convert from atomic_t to refcount_t on mempolicy->refcnt
refcount_t type and corresponding API can protect refcounters from
accidental underflow and overflow and further use-after-free situations.
[akpm@xxxxxxxxxxxxxxxxxxxx: fix warnings]
Link: https://lkml.kernel.org/r/1626683671-64407-1-git-send-email-xiyuyang19@xxxxxxxxxxxx
Signed-off-by: Xiyu Yang <xiyuyang19@xxxxxxxxxxxx>
Signed-off-by: Xin Tan <tanxin.ctf@xxxxxxxxx>
Acked-by: Ben Widawsky <ben.widawsky@xxxxxxxxx>
Reviewed-by: Muchun Song <songmuchun@xxxxxxxxxxxxx>
Cc: Feng Tang <feng.tang@xxxxxxxxx>
Cc: Mike Kravetz <mike.kravetz@xxxxxxxxxx>
Cc: Muchun Song <songmuchun@xxxxxxxxxxxxx>
Cc: Yanfei Xu <yanfei.xu@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
include/linux/mempolicy.h | 5 +++--
mm/mempolicy.c | 12 ++++++------
2 files changed, 9 insertions(+), 8 deletions(-)
--- a/include/linux/mempolicy.h~mm-mempolicy-convert-from-atomic_t-to-refcount_t-on-mempolicy-refcnt
+++ a/include/linux/mempolicy.h
@@ -6,6 +6,7 @@
#ifndef _LINUX_MEMPOLICY_H
#define _LINUX_MEMPOLICY_H 1
+#include <linux/refcount.h>
#include <linux/sched.h>
#include <linux/mmzone.h>
#include <linux/slab.h>
@@ -42,7 +43,7 @@ struct mm_struct;
* to 1, representing the caller of mpol_dup().
*/
struct mempolicy {
- atomic_t refcnt;
+ refcount_t refcnt;
unsigned short mode; /* See MPOL_* above */
unsigned short flags; /* See set_mempolicy() MPOL_F_* above */
nodemask_t nodes; /* interleave/bind/perfer */
@@ -94,7 +95,7 @@ static inline struct mempolicy *mpol_dup
static inline void mpol_get(struct mempolicy *pol)
{
if (pol)
- atomic_inc(&pol->refcnt);
+ refcount_inc(&pol->refcnt);
}
extern bool __mpol_equal(struct mempolicy *a, struct mempolicy *b);
--- a/mm/mempolicy.c~mm-mempolicy-convert-from-atomic_t-to-refcount_t-on-mempolicy-refcnt
+++ a/mm/mempolicy.c
@@ -123,7 +123,7 @@ enum zone_type policy_zone = 0;
* run-time system-wide default policy => local allocation
*/
static struct mempolicy default_policy = {
- .refcnt = ATOMIC_INIT(1), /* never free it */
+ .refcnt = { ATOMIC_INIT(1), }, /* never free it */
.mode = MPOL_LOCAL,
};
@@ -295,7 +295,7 @@ static struct mempolicy *mpol_new(unsign
policy = kmem_cache_alloc(policy_cache, GFP_KERNEL);
if (!policy)
return ERR_PTR(-ENOMEM);
- atomic_set(&policy->refcnt, 1);
+ refcount_set(&policy->refcnt, 1);
policy->mode = mode;
policy->flags = flags;
policy->home_node = NUMA_NO_NODE;
@@ -306,7 +306,7 @@ static struct mempolicy *mpol_new(unsign
/* Slow path of a mpol destructor. */
void __mpol_put(struct mempolicy *p)
{
- if (!atomic_dec_and_test(&p->refcnt))
+ if (!refcount_dec_and_test(&p->refcnt))
return;
kmem_cache_free(policy_cache, p);
}
@@ -2400,7 +2400,7 @@ struct mempolicy *__mpol_dup(struct memp
nodemask_t mems = cpuset_mems_allowed(current);
mpol_rebind_policy(new, &mems);
}
- atomic_set(&new->refcnt, 1);
+ refcount_set(&new->refcnt, 1);
return new;
}
@@ -2697,7 +2697,7 @@ restart:
goto alloc_new;
*mpol_new = *n->policy;
- atomic_set(&mpol_new->refcnt, 1);
+ refcount_set(&mpol_new->refcnt, 1);
sp_node_init(n_new, end, n->end, mpol_new);
n->end = start;
sp_insert(sp, n_new);
@@ -2891,7 +2891,7 @@ void __init numa_policy_init(void)
for_each_node(nid) {
preferred_node_policy[nid] = (struct mempolicy) {
- .refcnt = ATOMIC_INIT(1),
+ .refcnt = { ATOMIC_INIT(1), },
.mode = MPOL_PREFERRED,
.flags = MPOL_F_MOF | MPOL_F_MORON,
.nodes = nodemask_of_node(nid),
_
Patches currently in -mm which might be from xiyuyang19@xxxxxxxxxxxx are
mm-rmap-convert-from-atomic_t-to-refcount_t-on-anon_vma-refcount.patch
