[ANNOUNCE][CFP] Linux Security Summit Europe 2020

* Stephen Smalley, NSA * Elena Reshetova, Intel * John Johansen, Canonical * Kees Cook, Google * Casey Schaufler, Intel * Mimi Zohar, IBM * David A. Wheeler, Institute for Defense Analyses The program committee may be contacted as a group via email:

[PATCH] x86/entry/64: randomize kernel stack offset upon syscall

FSET has nothing in common. [4] https://www.openwall.com/lists/kernel-hardening/2019/02/08/6 Signed-off-by: Elena Reshetova --- arch/Kconfig| 15 +++ arch/x86/Kconfig| 1 + arch/x86/entry/common.c | 18 ++ 3 files changed, 34 insertions(+) diff --gi

[PATCH 1/1] x86/entry/64: randomize kernel stack offset upon syscall

ve two differences, the implementation of RANDKSTACK and RANDOMIZE_KSTACK_OFFSET has nothing in common. [4] https://www.openwall.com/lists/kernel-hardening/2019/02/08/6 Signed-off-by: Elena Reshetova --- arch/Kconfig| 15 +++ arch/x86/Kconfig| 1 + arch/x86/entry/common.c | 13 ++

[PATCH 0/1] v2, randomize stack offset upon syscall

Resending the patch since the first attempt never made it to lkml. changes in v2: - alloca() is changed to __builtin_alloca() in order to be compatible with 32 bit versions Elena Reshetova (1): x86/entry/64: randomize kernel stack offset upon syscall arch/Kconfig| 15

[RFC PATCH] x86/entry/64: randomize kernel stack offset upon syscall

above two differences, the implementation of RANDKSTACK and RANDOMIZE_KSTACK_OFFSET has nothing in common. [4] https://www.openwall.com/lists/kernel-hardening/2019/02/08/6 Signed-off-by: Elena Reshetova --- arch/Kconfig | 15 +++ arch/x86/Kconfig |

[PATCH 2/3] groups: convert group_info.usage to refcount_t

ounterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/cred.h | 7 --- kernel/cred.c| 2 +- kernel/groups.c | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/include/linu

[PATCH 1/3] nsproxy: convert nsproxy.count to refcount_t

ly ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/nsproxy.h | 6 +++--- kernel/nsproxy.c| 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/include/linux/n

[PATCH 3/3] creds: convert cred.usage to refcount_t

crement in refcount_dec_and_test() only provides RELEASE ordering and ACQUIRE ordering on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/cred.h | 8 ker

[PATCH 0/3] creds/cgroups/ns_proxy refcount_t conversions

be cherry-picked and discussed separately. More information about each conversion in each patch separately. Elena Reshetova (3): nsproxy: convert nsproxy.count to refcount_t groups: convert group_info.usage to refcount_t creds: convert cred.usage to refcount_t include/linux/cred.h| 15

[tip:locking/core] futex: Convert futex_pi_state.refcount to refcount_t

Commit-ID: 49262de2270e09882d7bd8866a691cdd69ab32f6 Gitweb: https://git.kernel.org/tip/49262de2270e09882d7bd8866a691cdd69ab32f6 Author: Elena Reshetova AuthorDate: Tue, 5 Feb 2019 14:24:27 +0200 Committer: Ingo Molnar CommitDate: Mon, 11 Feb 2019 11:37:16 +0100 futex: Convert

[PATCH] futex: convert futex_pi_state.refcount to refcount_t

ly ordered atomic counterpart - put_pi_state(): decrement in refcount_dec_and_test() provides RELEASE ordering and ACQUIRE ordering on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena

[tip:locking/core] refcount_t: Add ACQUIRE ordering on success for dec(sub)_and_test() variants

Commit-ID: 47b8f3ab9c49daa824af848f9e02889662d8638f Gitweb: https://git.kernel.org/tip/47b8f3ab9c49daa824af848f9e02889662d8638f Author: Elena Reshetova AuthorDate: Wed, 30 Jan 2019 13:18:51 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 09:03:31 +0100 refcount_t: Add ACQUIRE

[tip:sched/core] sched/core: Convert task_struct.stack_refcount to refcount_t

Commit-ID: f0b89d3958d73cd0785ec381f0ddf8efb6f183d8 Gitweb: https://git.kernel.org/tip/f0b89d3958d73cd0785ec381f0ddf8efb6f183d8 Author: Elena Reshetova AuthorDate: Fri, 18 Jan 2019 14:27:30 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:53:56 +0100 sched/core: Convert

[tip:sched/core] sched/core: Convert task_struct.usage to refcount_t

Commit-ID: ec1d281923cf81cc660343d0cb8ffc837ffb991d Gitweb: https://git.kernel.org/tip/ec1d281923cf81cc660343d0cb8ffc837ffb991d Author: Elena Reshetova AuthorDate: Fri, 18 Jan 2019 14:27:29 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:53:55 +0100 sched/core: Convert

[tip:sched/core] sched/fair: Convert numa_group.refcount to refcount_t

Commit-ID: c45a77952427b678aa9205e1b0ee3bcf9a2e Gitweb: https://git.kernel.org/tip/c45a77952427b678aa9205e1b0ee3bcf9a2e Author: Elena Reshetova AuthorDate: Fri, 18 Jan 2019 14:27:28 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:53:54 +0100 sched/fair: Convert

[tip:sched/core] sched/core: Convert signal_struct.sigcnt to refcount_t

Commit-ID: 60d4de3ff7f775509deba94b3db3c1abe55bf7a5 Gitweb: https://git.kernel.org/tip/60d4de3ff7f775509deba94b3db3c1abe55bf7a5 Author: Elena Reshetova AuthorDate: Fri, 18 Jan 2019 14:27:27 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:53:53 +0100 sched/core: Convert

[tip:sched/core] sched/core: Convert sighand_struct.count to refcount_t

Commit-ID: d036bda7d0e7269c2982eb979acfef855f5d7977 Gitweb: https://git.kernel.org/tip/d036bda7d0e7269c2982eb979acfef855f5d7977 Author: Elena Reshetova AuthorDate: Fri, 18 Jan 2019 14:27:26 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:53:52 +0100 sched/core: Convert

[tip:perf/core] perf/ring_buffer: Convert ring_buffer.aux_refcount to refcount_t

Commit-ID: ca3bb3d027f69ac3ab1dafb32bde2f5a3a44439c Gitweb: https://git.kernel.org/tip/ca3bb3d027f69ac3ab1dafb32bde2f5a3a44439c Author: Elena Reshetova AuthorDate: Mon, 28 Jan 2019 14:27:28 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:46:17 +0100 perf/ring_buffer

[tip:perf/core] perf/ring_buffer: Convert ring_buffer.refcount to refcount_t

Commit-ID: fecb8ed2ce7010db373f8517ee815380d8e3c0c4 Gitweb: https://git.kernel.org/tip/fecb8ed2ce7010db373f8517ee815380d8e3c0c4 Author: Elena Reshetova AuthorDate: Mon, 28 Jan 2019 14:27:27 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:46:16 +0100 perf/ring_buffer

[tip:perf/core] perf: Convert perf_event_context.refcount to refcount_t

Commit-ID: 8c94abbbe1ba24961278055434504b7dc3595415 Gitweb: https://git.kernel.org/tip/8c94abbbe1ba24961278055434504b7dc3595415 Author: Elena Reshetova AuthorDate: Mon, 28 Jan 2019 14:27:26 +0200 Committer: Ingo Molnar CommitDate: Mon, 4 Feb 2019 08:46:15 +0100 perf: Convert

[PATCH] refcount_t: add ACQUIRE ordering on success for dec(sub)_and_test variants

: Elena Reshetova --- Documentation/core-api/refcount-vs-atomic.rst | 24 +--- arch/x86/include/asm/refcount.h | 22 ++ lib/refcount.c| 18 +- 3 files changed, 52 insertions(+), 12 deletions

[PATCH v2] Adding smp_acquire__after_ctrl_dep barrier

letter, because I think it is Intel mailer that malformed the patch last time for god knows what reason... Elena Reshetova (1): refcount_t: add ACQUIRE ordering on success for dec(sub)_and_test variants Documentation/core-api/refcount-vs-atomic.rst | 24 +--- arch/x86

[PATCH 1/3] perf: convert perf_event_context.refcount to refcount_t

eviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/perf_event.h | 3 ++- kernel/events/core.c | 12 ++-- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h ind

[PATCH 0/3] perf refcount_t conversions

Another set of old patches, rebased and this time the commits also updated since we merged the docs in past and also refcount_dec_and_test() gets new acquire ordering on success very soon, which is also reflected in commit messages. Elena Reshetova (3): perf: convert

[PATCH 3/3] perf/ring_buffer: convert ring_buffer.aux_refcount to refcount_t

atomic counterpart - rb_free_aux(): decrement in refcount_dec_and_test() only provides RELEASE ordering and ACQUIRE ordering + control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena

[PATCH 2/3] perf/ring_buffer: convert ring_buffer.refcount to refcount_t

ounterpart - ring_buffer_put(): decrement in refcount_dec_and_test() only provides RELEASE ordering and ACQUIRE ordering + control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena

[PATCH] refcount_t: add ACQUIRE ordering on success for dec(sub)_and_test variants

: Elena Reshetova --- Documentation/core-api/refcount-vs-atomic.rst | 28 +++ arch/x86/include/asm/refcount.h | 21 lib/refcount.c| 16 ++- 3 files changed, 52 insertions(+), 13 deletions(-) diff

[PATCH 3/5] sched: convert numa_group.refcount to refcount_t

iljestrand Signed-off-by: Elena Reshetova --- kernel/sched/fair.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7303e0b..32a2382 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1035,7 +1035,7 @@ un

[PATCH 4/5] sched/task_struct: convert task_struct.usage to refcount_t

dering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/sched.h | 3 ++- include/linux/sched/task.h | 4 ++-- init/init_task.c | 2

[PATCH 5/5] sched/task_struct: convert task_struct.stack_refcount to refcount_t

eviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/init_task.h| 1 + include/linux/sched.h| 2 +- include/linux/sched/task_stack.h | 2 +- init/init_task.c | 2 +- kernel/fork.c| 6 +++--- 5 files changed, 7 insert

[PATCH 2/5] sched: convert signal_struct.sigcnt to refcount_t

E ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/sched/signal.h | 2 +- init/init_task.c | 2 +- kernel/fork.c

[PATCH 1/5] sched: convert sighand_struct.count to refcount_t

dering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/exec.c| 4 ++-- fs/proc/task_nommu.c | 2 +- include/linux/sched/si

[PATCH 0/5] sched refcount_t conversions

vulnerabilities. The patches are fully independent and can be cherry-picked separately. More information about each conversion in each patch separately. Elena Reshetova (5): sched: convert sighand_struct.count to refcount_t sched: convert signal_struct.sigcnt to refcount_t sched: convert

[PATCH] uprobes: convert uprobe.ref to refcount_t

endency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/events/uprobes.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/events/uprobes.

[PATCH] kcov: convert kcov.refcount to refcount_t

endency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/kcov.c | 9 + 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/kcov.c b/kernel/kc

[PATCH] docs: refcount_t documentation

Some functions from refcount_t API provide different memory ordering guarantees that their atomic counterparts. This adds a document outlining these differences ( Documentation/core-api/refcount-vs-atomic.rst) as well as some other minor improvements. Signed-off-by: Elena Reshetova Signed-off-by

[PATCH v3] refcount_t vs. atomic_t ordering differences

roved: * definitions now in the beginning * confusing examples removed * less redundancy overall and more up-to-the-point text - definitions try to follow LKMM defined in github.com/aparri/memory-model/blob/master/Documentation/explanation.txt Elena Reshetova (1): refcount_t: documentatio

[PATCH] refcount_t: documentation for memory ordering differences

Some functions from refcount_t API provide different memory ordering guarantees that their atomic counterparts. This adds a document outlining these differences. Signed-off-by: Elena Reshetova --- Documentation/core-api/index.rst | 1 + Documentation/core-api/refcount-vs

[PATCH 0/5] v2 xfs refcount conversions

dependent and can be cherry-picked separately. If there are no objections to the patches, please merge them via respective trees. Elena Reshetova (5): fs, xfs: convert xfs_bui_log_item.bui_refcount from atomic_t to refcount_t fs, xfs: convert xfs_efi_log_item.efi_refcount from atomic_t to

[PATCH 4/5] fs, xfs: convert xfs_cui_log_item.cui_refcount from atomic_t to refcount_t

provides RELEASE ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_refcount_item.c | 6 +++--- fs/xfs/xfs_refcount_item.h | 2 +- 2 fil

[PATCH 5/5] fs, xfs: convert xfs_rui_log_item.rui_refcount from atomic_t to refcount_t

provides RELEASE ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_rmap_item.c | 6 +++--- fs/xfs/xfs_rmap_item.h | 2 +- 2 files

[PATCH 3/5] fs, xfs: convert xlog_ticket.t_ref from atomic_t to refcount_t

dering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_log.c | 10 +- fs/xfs/xfs_log_priv.h | 2 +- 2 files changed, 6 insert

[PATCH 1/5] fs, xfs: convert xfs_bui_log_item.bui_refcount from atomic_t to refcount_t

provides RELEASE ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_bmap_item.c | 6 +++--- fs/xfs/xfs_bmap_item.h | 2 +- fs/xfs/x

[PATCH 2/5] fs, xfs: convert xfs_efi_log_item.efi_refcount from atomic_t to refcount_t

provides RELEASE ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_extfree_item.c | 6 +++--- fs/xfs/xfs_extfree_item.h | 2 +- 2 files

[PATCH] mbcache: convert mb_cache_entry.e_refcnt from atomic_t to refcount_t

vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/mbcache.c| 16 include/linux/mbcache.h | 6 +++--- 2 files changed, 11 insertions(+), 11 deletions(-) diff

[PATCH] posix_acl: convert posix_acl.a_refcount from atomic_t to refcount_t

red atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/f2fs/acl.c | 2 +- fs/posix_acl.c| 6 +++--- include/linux/posix_acl.h | 7 --- 3 files changed, 8 insertions(+), 7 deletions(-)

[PATCH] mnt_namespace: convert mnt_namespace.count from atomic_t to refcount_t

nd control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/mount.h | 5 +++-- fs/namespace.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) di

[PATCH] fs: convert super_block.s_active from atomic_t to refcount_t

David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- drivers/staging/lustre/lustre/llite/llite_lib.c | 2 +- fs/cifs/cifsfs.c| 2 +- fs/devpts/inode.c | 2 +- fs/gfs2/super.c | 2

[PATCH] userfaultfd: convert userfaultfd_ctx.refcount from atomic_t to refcount_t

eviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/userfaultfd.c | 11 ++- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index ac9a4e6..b63ebcac 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -29,6 +29,7 @@

[PATCH 3/4] lockd: convert nlm_lockowner.count from atomic_t to refcount_t

E ordering, control dependency on success and holds a spin lock on success vs. fully ordered atomic counterpart. No changes in spin lock guarantees. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/lockd/clntproc.c

[PATCH 2/4] lockd: convert nsm_handle.sm_count from atomic_t to refcount_t

g, control dependency on success and holds a spin lock on success vs. fully ordered atomic counterpart. No change for the spin lock guarantees. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/lockd/host.c |

[PATCH 1/4] lockd: convert nlm_host.h_count from atomic_t to refcount_t

matter in this case since object freeing happens under mutex lock anyway. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/lockd/host.c | 14 +++--- include/linux/lockd/lockd.h | 3 ++- 2 files change

[PATCH 4/4] lockd: convert nlm_rqst.a_count from atomic_t to refcount_t

est() only provides RELEASE ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/lockd/clntproc.c | 8 fs/lockd/svcproc.c

[PATCH 0/4] lockd refcount conversions

and can be cherry-picked separately. If there are no objections to the patches, please merge them via respective tree. Elena Reshetova (4): lockd: convert nlm_host.h_count from atomic_t to refcount_t lockd: convert nsm_handle.sm_count from atomic_t to refcount_t lockd: convert

[PATCH 12/16] nsproxy: convert nsproxy.count to refcount_t

es RELEASE ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/nsproxy.h | 6 +++--- kernel/nsproxy.c| 6 +++--- 2 files

[PATCH 00/16] v6 kernel core pieces refcount conversions

rry-picked separately. If there are no objections to the patches, please merge them via respective trees. Elena Reshetova (16): futex: convert futex_pi_state.refcount to refcount_t sched: convert sighand_struct.count to refcount_t sched: convert signal_struct.sigcnt to refcount_t sched: convert u

[PATCH 11/16] uprobes: convert uprobe.ref to refcount_t

endency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/events/uprobes.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/events/uprobes.

[PATCH 06/16] sched/task_struct: convert task_struct.usage to refcount_t

dering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/init_task.h | 2 +- include/linux/sched.h | 3 ++- include/linux/sched/task.h | 4 ++

[PATCH 07/16] sched/task_struct: convert task_struct.stack_refcount to refcount_t

eviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/init_task.h| 3 ++- include/linux/sched.h| 2 +- include/linux/sched/task_stack.h | 2 +- kernel/fork.c| 6 +++--- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/inc

[PATCH 08/16] perf: convert perf_event_context.refcount to refcount_t

red atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/perf_event.h | 3 ++- kernel/events/core.c | 12 ++-- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/inc

[PATCH 14/16] creds: convert cred.usage to refcount_t

vs. fully ordered atomic counterpart - put_cred(): decrement in refcount_dec_and_test() only provides RELEASE ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off

[PATCH 16/16] bdi: convert bdi_writeback_congested.refcnt from atomic_t to refcount_t

_lock() on success vs. fully ordered atomic counterpart. Note, there is no difference in spin lock locking. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/backing-dev-defs.h | 3 ++- include/linux/bac

[PATCH 15/16] kcov: convert kcov.refcount to refcount_t

endency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/kcov.c | 9 + 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/kcov.c b/kernel/kc

[PATCH 13/16] groups: convert group_info.usage to refcount_t

nd control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/cred.h | 7 --- kernel/cred.c| 2 +- kernel/groups.c | 2 +- 3 files

[PATCH 09/16] perf/ring_buffer: convert ring_buffer.refcount to refcount_t

d-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/events/core.c| 4 ++-- kernel/events/internal.h| 3 ++- kernel/events/ring_buffer.c | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 29c381f..3497c6a 100644 --

[PATCH 03/16] sched: convert signal_struct.sigcnt to refcount_t

E ordering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/sched/signal.h | 2 +- kernel/fork.c| 6 +++--- 2 files

[PATCH 10/16] perf/ring_buffer: convert ring_buffer.aux_refcount to refcount_t

d-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/events/core.c| 2 +- kernel/events/internal.h| 2 +- kernel/events/ring_buffer.c | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 3497c6a..5f08

[PATCH 04/16] sched: convert user_struct.__count to refcount_t

g, control dependency on success and will hold a spin lock on success vs. fully ordered atomic counterpart. Note there is no changes in spin lock locking here. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/l

[PATCH 05/16] sched: convert numa_group.refcount to refcount_t

iljestrand Signed-off-by: Elena Reshetova --- kernel/sched/fair.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 4037e19..b456b94 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1052,7 +1052,7 @@ un

[PATCH 02/16] sched: convert sighand_struct.count to refcount_t

dering and control dependency on success vs. fully ordered atomic counterpart Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/exec.c| 4 ++-- fs/proc/task_nommu.c | 2 +- include/linux/init_tas

[PATCH 01/16] futex: convert futex_pi_state.refcount to refcount_t

id Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/futex.c | 15 --- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index 76ed592..907055f 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -67,6 +67,7 @@

[PATCH] refcount_t: documentation for memory ordering differences

Some functions from refcount_t API provide different memory ordering guarantees that their atomic counterparts. This adds a document outlining these differences. Signed-off-by: Elena Reshetova --- Documentation/refcount-vs-atomic.txt | 124 +++ 1 file changed

[PATCH v2] refcount_t vs. atomic_t ordering differences

LKMM defined in github.com/aparri/memory-model/blob/master/Documentation/explanation.txt Elena Reshetova (1): refcount_t: documentation for memory ordering differences Documentation/refcount-vs-atomic.txt | 124 +++ 1 file changed, 124 insertions(+) create mode 1

[PATCH] refcount_t: documentation for memory ordering differences

Some functions from refcount_t API provide different memory ordering guarantees that their atomic counterparts. This adds a document outlining the differences and showing examples. Signed-off-by: Elena Reshetova --- Documentation/refcount-vs-atomic.txt | 234

[PATCH] refcount: provide same memory ordering guarantees as in atomic_t

APIs. Suggested-by: Kees Cook Signed-off-by: Elena Reshetova --- lib/refcount.c | 71 +- 1 file changed, 6 insertions(+), 65 deletions(-) diff --git a/lib/refcount.c b/lib/refcount.c index 5d0582a..cc6946e 100644 --- a/lib/refcount.c +++ b

[PATCH 04/15] sched: convert numa_group.refcount to refcount_t

ation and be exploitable. The variable numa_group.refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/sched/fair.c

[PATCH 11/15] nsproxy: convert nsproxy.count to refcount_t

ation and be exploitable. The variable nsproxy.count is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/nsproxy.h | 6 +++--- k

[PATCH 12/15] groups: convert group_info.usage to refcount_t

ation and be exploitable. The variable group_info.usage is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/cred.

[PATCH 14/15] kcov: convert kcov.refcount to refcount_t

ation and be exploitable. The variable kcov.refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/kcov.c | 9 + 1

[PATCH 15/15] bdi: convert bdi_writeback_congested.refcnt from atomic_t to refcount_t

ation and be exploitable. The variable bdi_writeback_congested.refcnt is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/backin

[PATCH 13/15] creds: convert cred.usage to refcount_t

ation and be exploitable. The variable cred.usage is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/cred.h | 6 +++--- k

[PATCH 08/15] perf/ring_buffer: convert ring_buffer.refcount to refcount_t

ation and be exploitable. The variable ring_buffer.refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/events/core.c

[PATCH 07/15] perf: convert perf_event_context.refcount to refcount_t

ation and be exploitable. The variable perf_event_context.refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/perf_ev

[PATCH 09/15] perf/ring_buffer: convert ring_buffer.aux_refcount to refcount_t

ation and be exploitable. The variable ring_buffer.aux_refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/events/core.c

[PATCH 10/15] uprobes: convert uprobe.ref to refcount_t

ation and be exploitable. The variable uprobe.ref is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- kernel/events/uprobes.c | 8 1

[PATCH 01/15] sched: convert sighand_struct.count to refcount_t

ation and be exploitable. The variable sighand_struct.count is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/exec.c

[PATCH 06/15] sched/task_struct: convert task_struct.stack_refcount to refcount_t

ation and be exploitable. The variable task_struct.stack_refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/init_t

[PATCH 03/15] sched: convert user_struct.__count to refcount_t

ation and be exploitable. The variable user_struct.__count is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/sched/user.

[PATCH 00/15] v5 kernel core pieces refcount conversions

that can led to use-after-free vulnerabilities. The patches are fully independent and can be cherry-picked separately. If there are no objections to the patches, please merge them via respective trees. Elena Reshetova (15): sched: convert sighand_struct.count to refcount_t sched: convert

[PATCH 02/15] sched: convert signal_struct.sigcnt to refcount_t

ation and be exploitable. The variable signal_struct.sigcnt is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/sched/signal.

[PATCH 05/15] sched/task_struct: convert task_struct.usage to refcount_t

ation and be exploitable. The variable task_struct.usage is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- include/linux/init_task.h

[PATCH 1/5] fs, xfs: convert xfs_bui_log_item.bui_refcount from atomic_t to refcount_t

ation and be exploitable. The variable xfs_bui_log_item.bui_refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_bmap_item.

[PATCH 0/5] xfs refcount conversions

icked separately. If there are no objections to the patches, please merge them via respective trees. Elena Reshetova (5): fs, xfs: convert xfs_bui_log_item.bui_refcount from atomic_t to refcount_t fs, xfs: convert xfs_efi_log_item.efi_refcount from atomic_t to refcount_t fs, xfs: co

[PATCH 4/5] fs, xfs: convert xfs_cui_log_item.cui_refcount from atomic_t to refcount_t

ation and be exploitable. The variable xfs_cui_log_item.cui_refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_refcount_i

[PATCH 2/5] fs, xfs: convert xfs_efi_log_item.efi_refcount from atomic_t to refcount_t

ation and be exploitable. The variable xfs_efi_log_item.efi_refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_extfree_i

[PATCH 3/5] fs, xfs: convert xlog_ticket.t_ref from atomic_t to refcount_t

ation and be exploitable. The variable xlog_ticket.t_ref is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_log.c

[PATCH 5/5] fs, xfs: convert xfs_rui_log_item.rui_refcount from atomic_t to refcount_t

ation and be exploitable. The variable xfs_rui_log_item.rui_refcount is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/xfs/xfs_rmap_item.

[PATCH] ncpfs: convert ncp_request_reply.refs from atomic_t to refcount_t

ation and be exploitable. The variable ncp_request_reply.refs is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/ncpfs/sock.c | 9 +--

[PATCH] fs, nilfs: convert nilfs_root.count from atomic_t to refcount_t

ation and be exploitable. The variable nilfs_root.count is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/nilfs2/the_nilfs.c | 8 ---

[PATCH] fs, cifs: convert tcon_link.tl_count from atomic_t to refcount_t

ation and be exploitable. The variable tcon_link.tl_count is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook Reviewed-by: David Windsor Reviewed-by: Hans Liljestrand Signed-off-by: Elena Reshetova --- fs/cifs/cifsglob.h | 5 +++-- fs

  1   2   3   4   5   6   7   >