Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751832AbdGYMFa (ORCPT <rfc822;w@1wt.eu>);
        Tue, 25 Jul 2017 08:05:30 -0400
Received: from szxga05-in.huawei.com ([45.249.212.191]:2106 "EHLO
        szxga05-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750732AbdGYMF1 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 25 Jul 2017 08:05:27 -0400
Subject: Re: [kernel-hardening] [PATCH v8 3/3] x86/refcount: Implement fast
 refcount overflow protection
To: Kees Cook <keescook@chromium.org>, Ingo Molnar <mingo@kernel.org>
References: <1500921349-10803-1-git-send-email-keescook@chromium.org>
 <1500921349-10803-4-git-send-email-keescook@chromium.org>
CC: Peter Zijlstra <peterz@infradead.org>,
        Josh Poimboeuf <jpoimboe@redhat.com>,
        Christoph Hellwig <hch@infradead.org>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Jann Horn <jannh@google.com>, Eric Biggers <ebiggers3@gmail.com>,
        Elena Reshetova <elena.reshetova@intel.com>,
        "Hans Liljestrand" <ishkamiel@gmail.com>,
        Greg KH <gregkh@linuxfoundation.org>,
        Alexey Dobriyan <adobriyan@gmail.com>,
        "Serge E. Hallyn" <serge@hallyn.com>, <arozansk@redhat.com>,
        Davidlohr Bueso <dave@stgolabs.net>,
        Manfred Spraul <manfred@colorfullife.com>,
        "axboe@kernel.dk" <axboe@kernel.dk>,
        "James Bottomley" <James.Bottomley@hansenpartnership.com>,
        "x86@kernel.org" <x86@kernel.org>, Arnd Bergmann <arnd@arndb.de>,
        "David S. Miller" <davem@davemloft.net>,
        Rik van Riel <riel@redhat.com>, <linux-kernel@vger.kernel.org>,
        linux-arch <linux-arch@vger.kernel.org>,
        "kernel-hardening@lists.openwall.com" 
        <kernel-hardening@lists.openwall.com>
From: Li Kun <hw.likun@huawei.com>
Message-ID: <7e7918c6-7186-47f4-4b37-2fc55db1e678@huawei.com>
Date: Tue, 25 Jul 2017 20:03:08 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.6.0
MIME-Version: 1.0
In-Reply-To: <1500921349-10803-4-git-send-email-keescook@chromium.org>
Content-Type: text/plain; charset="windows-1252"; format=flowed
Content-Transfer-Encoding: 7bit
X-Originating-IP: [10.111.203.133]
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0),
        refid=str=0001.0A020201.5977338A.0003,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,
        ip=0.0.0.0,
        so=2014-11-16 11:51:01,
        dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: 6b452545ee39aa5530a4cda9d9e743cb
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 750
Lines: 39

Hi Kees,


on 2017/7/25 2:35, Kees Cook wrote:
> +static __always_inline __must_check
> +int __refcount_add_unless(refcount_t *r, int a, int u)
> +{
> +	int c, new;
> +
> +	c = atomic_read(&(r->refs));
> +	do {
> +		if (unlikely(c == u))
> +			break;
> +
> +		asm volatile("addl %2,%0\n\t"
> +			REFCOUNT_CHECK_LT_ZERO
> +			: "=r" (new)
> +			: "0" (c), "ir" (a),
> +			  [counter] "m" (r->refs.counter)
> +			: "cc", "cx");
here when the result LT_ZERO, you will saturate the r->refs.counter and 
make the

atomic_try_cmpxchg(&(r->refs), &c, new) bound to fail first time.

maybe we can just saturate the value of variable "new" ?
  


> +
> +	} while (!atomic_try_cmpxchg(&(r->refs), &c, new));
> +
> +	return c;
> +}
> +

-- 
Best Regards
Li Kun