Date: Thu, 17 Nov 2016 14:22:06 +0100
From: Peter Zijlstra <peterz@infradead.org>
To: "Reshetova, Elena" <elena.reshetova@intel.com>
Cc: David Windsor <dave@progbits.org>, Kees Cook <keescook@chromium.org>,
        Greg KH <gregkh@linuxfoundation.org>,
        Will Deacon <will.deacon@arm.com>, Arnd Bergmann <arnd@arndb.de>,
        Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@kernel.org>,
        "H. Peter Anvin" <hpa@zytor.com>, LKML <linux-kernel@vger.kernel.org>,
        Alexei Starovoitov <alexei.starovoitov@gmail.com>,
        Daniel Borkmann <daniel@iogearbox.net>
Subject: Re: [RFC][PATCH 2/7] kref: Add kref_read()
Message-ID: <20161117132206.GE3117@twins.programming.kicks-ass.net>
References: <20161114174446.486581399@infradead.org>
 <20161115073322.GC28248@kroah.com>
 <20161115080314.GD3142@twins.programming.kicks-ass.net>
 <CAGXu5jLNduviFkM1A4ozub_n2uB2nAHrhE41BsPFJZq+uhn4Mg@mail.gmail.com>
 <20161116100925.GM3142@twins.programming.kicks-ass.net>
 <CAGXu5jL0LD22TnEfu8QTG29Apr09Zht-gekNjnBHcnCLxBbLUw@mail.gmail.com>
 <20161117083458.GZ3142@twins.programming.kicks-ass.net>
 <CAEXv5_gS4iuHNQtRz=swKJFH06KUJvg9-Ov+XLTptgo1tnAguw@mail.gmail.com>
 <20161117124339.GC3117@twins.programming.kicks-ass.net>
 <2236FBA76BA1254E88B949DDB74E612B41C14089@IRSMSX102.ger.corp.intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2236FBA76BA1254E88B949DDB74E612B41C14089@IRSMSX102.ger.corp.intel.com>
User-Agent: Mutt/1.5.23.1 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 992
Lines: 22

On Thu, Nov 17, 2016 at 01:01:49PM +0000, Reshetova, Elena wrote:

> >I think the sole motivator is a general distaste of atomic_t, which isn't a good reason at all.
> 
> I don't think anyone has this as motivation. But atomic_t is so
> powerful and flexible that easily ends up being misused (as past CVEs
> shown). 

I don't think using atomic_t as reference count is abuse. There simply
wasn't anything better. The proposed refcount_t cures this.

> Even if we now find all occurrences of atomic_t used as
> refcounter (which we cannot actually guarantee in any case unless
> someone manually reads every line) and convert it to refcount_t, we
> still have atomic_t type present and new usage of it as refount will
> crawl in. It is just a matter of time IMO.

Improve tooling. The patterns shouldn't be _that_ hard to find. Once the
tools are good, new code isn't a problem either.

Anything: atomic*_{{dec,sub}_and_test,{add,sub}_return,fetch_{add,sub}}
followed by a call_rcu()/free().