search for: refcount_set

...ar instance, it does the following: if (!refcount_inc_not_zero(&iobj->maps)) { ... refcount_inc(&iobj->maps); } i.e., it calls refcount_inc() to increment the refcount when it is known to be zero, which is explicitly forbidden by the API. Instead, use refcount_set() to set it to 1. Signed-off-by: Ard Biesheuvel <ard.biesheuvel at linaro.org> --- Apologies if this was already found and fixed. I don't usually follow the DRM or nouveau mailing lists. drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 2 +- 1 file changed, 1 insertion(+), 1 delet...

...amp;iobj->maps)) { > > ... > > refcount_inc(&iobj->maps); > > } > > > > i.e., it calls refcount_inc() to increment the refcount when it is known > > to be zero, which is explicitly forbidden by the API. Instead, use > > refcount_set() to set it to 1. > > > > Signed-off-by: Ard Biesheuvel <ard.biesheuvel at linaro.org> > > --- > > > > Apologies if this was already found and fixed. I don't usually follow > > the DRM or nouveau mailing lists. > > > > drivers/gpu/drm/nouve...

...t; if (!refcount_inc_not_zero(&iobj->maps)) { > ... > refcount_inc(&iobj->maps); > } > > i.e., it calls refcount_inc() to increment the refcount when it is known > to be zero, which is explicitly forbidden by the API. Instead, use > refcount_set() to set it to 1. > > Signed-off-by: Ard Biesheuvel <ard.biesheuvel at linaro.org> > --- > > Apologies if this was already found and fixed. I don't usually follow > the DRM or nouveau mailing lists. > > drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 2 +- &gt...

...all the KVM/KVMI structures are linked and no pointer > + * is read as NULL after the reference count has been set. > + */ > + smp_mb__before_atomic(); This is an smp_wmb(), not an smp_mb__before_atomic(). Add a comment that it pairs with the refcount_inc_not_zero in kvmi_get. > + refcount_set(&kvm->kvmi_ref, 1); > + > @@ -57,8 +183,27 @@ void kvmi_destroy_vm(struct kvm *kvm) > if (!ikvm) > return; > > + /* trigger socket shutdown - kvmi_recv() will start shutdown process */ > + kvmi_sock_shutdown(ikvm); > + > kvmi_put(kvm); > > /* w...

...nvq->ubuf_info + nvq->upend_idx; - - vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head); - vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS; - ubuf->callback = vhost_zerocopy_callback; - ubuf->ctx = nvq->ubufs; - ubuf->desc = nvq->upend_idx; - refcount_set(&ubuf->refcnt, 1); - msg.msg_control = ubuf; - msg.msg_controllen = sizeof(ubuf); - ubufs = nvq->ubufs; - atomic_inc(&ubufs->refcount); - nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV; - } else { - msg.msg_control = NULL; - ubufs = NULL; - } + for (i = 0...

...erations virtblk_fops = { .owner = THIS_MODULE, + .open = virtblk_open, + .release = virtblk_release, .getgeo = virtblk_getgeo, }; @@ -655,6 +715,10 @@ static int virtblk_probe(struct virtio_device *vdev) goto out_free_index; } + /* This reference is dropped in virtblk_remove(). */ + refcount_set(&vblk->refs, 1); + mutex_init(&vblk->remove_mutex); + vblk->vdev = vdev; vblk->sg_elems = sg_elems; @@ -820,8 +884,12 @@ static int virtblk_probe(struct virtio_device *vdev) static void virtblk_remove(struct virtio_device *vdev) { struct virtio_blk *vblk = vdev->pri...

...erations virtblk_fops = { .owner = THIS_MODULE, + .open = virtblk_open, + .release = virtblk_release, .getgeo = virtblk_getgeo, }; @@ -655,6 +715,10 @@ static int virtblk_probe(struct virtio_device *vdev) goto out_free_index; } + /* This reference is dropped in virtblk_remove(). */ + refcount_set(&vblk->refs, 1); + mutex_init(&vblk->remove_mutex); + vblk->vdev = vdev; vblk->sg_elems = sg_elems; @@ -820,8 +884,12 @@ static int virtblk_probe(struct virtio_device *vdev) static void virtblk_remove(struct virtio_device *vdev) { struct virtio_blk *vblk = vdev->pri...

...; size_t len, total_len = 0; > int err; > struct vhost_net_ubuf_ref *uninitialized_var(ubufs); > @@ -664,8 +665,10 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock) > ubuf->ctx = nvq->ubufs; > ubuf->desc = nvq->upend_idx; > refcount_set(&ubuf->refcnt, 1); > - msg.msg_control = ubuf; > - msg.msg_controllen = sizeof(ubuf); > + msg.msg_control = &ctl; > + ctl.type = TUN_MSG_UBUF; > + ctl.ptr = ubuf; > + msg.msg_controllen = sizeof(ctl); > ubufs = nvq->ubufs; > atomic_inc(&...

...re/memory.c b/drivers/gpu/drm/nouveau/nvkm/core/memory.c index e85a08ecd9da5..4cc186262d344 100644 --- a/drivers/gpu/drm/nouveau/nvkm/core/memory.c +++ b/drivers/gpu/drm/nouveau/nvkm/core/memory.c @@ -91,8 +91,8 @@ nvkm_memory_tags_get(struct nvkm_memory *memory, struct nvkm_device *device, } refcount_set(&tags->refcount, 1); + *ptags = memory->tags = tags; mutex_unlock(&fb->subdev.mutex); - *ptags = tags; return 0; } -- 2.20.1

...re/memory.c b/drivers/gpu/drm/nouveau/nvkm/core/memory.c index e85a08ecd9da5..4cc186262d344 100644 --- a/drivers/gpu/drm/nouveau/nvkm/core/memory.c +++ b/drivers/gpu/drm/nouveau/nvkm/core/memory.c @@ -91,8 +91,8 @@ nvkm_memory_tags_get(struct nvkm_memory *memory, struct nvkm_device *device, } refcount_set(&tags->refcount, 1); + *ptags = memory->tags = tags; mutex_unlock(&fb->subdev.mutex); - *ptags = tags; return 0; } -- 2.20.1

...re/memory.c b/drivers/gpu/drm/nouveau/nvkm/core/memory.c index e85a08ecd9da5..4cc186262d344 100644 --- a/drivers/gpu/drm/nouveau/nvkm/core/memory.c +++ b/drivers/gpu/drm/nouveau/nvkm/core/memory.c @@ -91,8 +91,8 @@ nvkm_memory_tags_get(struct nvkm_memory *memory, struct nvkm_device *device, } refcount_set(&tags->refcount, 1); + *ptags = memory->tags = tags; mutex_unlock(&fb->subdev.mutex); - *ptags = tags; return 0; } -- 2.20.1

...rtblk_release, > > .getgeo = virtblk_getgeo, > > }; > > > > @@ -655,6 +715,10 @@ static int virtblk_probe(struct virtio_device *vdev) > > goto out_free_index; > > } > > > > + /* This reference is dropped in virtblk_remove(). */ > > + refcount_set(&vblk->refs, 1); > > + mutex_init(&vblk->remove_mutex); > > + > > vblk->vdev = vdev; > > vblk->sg_elems = sg_elems; > > > > @@ -820,8 +884,12 @@ static int virtblk_probe(struct virtio_device *vdev) > > static void virtblk_remove(s...

...idx; > - > - vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head); > - vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS; > - ubuf->callback = vhost_zerocopy_callback; > - ubuf->ctx = nvq->ubufs; > - ubuf->desc = nvq->upend_idx; > - refcount_set(&ubuf->refcnt, 1); > - msg.msg_control = ubuf; > - msg.msg_controllen = sizeof(ubuf); > - ubufs = nvq->ubufs; > - atomic_inc(&ubufs->refcount); > - nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV; > - } else { > - msg.msg_control = NULL; &...

...idx; > - > - vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head); > - vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS; > - ubuf->callback = vhost_zerocopy_callback; > - ubuf->ctx = nvq->ubufs; > - ubuf->desc = nvq->upend_idx; > - refcount_set(&ubuf->refcnt, 1); > - msg.msg_control = ubuf; > - msg.msg_controllen = sizeof(ubuf); > - ubufs = nvq->ubufs; > - atomic_inc(&ubufs->refcount); > - nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV; > - } else { > - msg.msg_control = NULL; &...

...erations virtblk_fops = { .owner = THIS_MODULE, + .open = virtblk_open, + .release = virtblk_release, .getgeo = virtblk_getgeo, }; @@ -655,6 +721,10 @@ static int virtblk_probe(struct virtio_device *vdev) goto out_free_index; } + /* This reference is dropped in virtblk_remove(). */ + refcount_set(&vblk->refs, 1); + mutex_init(&vblk->vdev_mutex); + vblk->vdev = vdev; vblk->sg_elems = sg_elems; @@ -820,8 +890,6 @@ static int virtblk_probe(struct virtio_device *vdev) static void virtblk_remove(struct virtio_device *vdev) { struct virtio_blk *vblk = vdev->priv;...

...erations virtblk_fops = { .owner = THIS_MODULE, + .open = virtblk_open, + .release = virtblk_release, .getgeo = virtblk_getgeo, }; @@ -655,6 +721,10 @@ static int virtblk_probe(struct virtio_device *vdev) goto out_free_index; } + /* This reference is dropped in virtblk_remove(). */ + refcount_set(&vblk->refs, 1); + mutex_init(&vblk->vdev_mutex); + vblk->vdev = vdev; vblk->sg_elems = sg_elems; @@ -820,8 +890,6 @@ static int virtblk_probe(struct virtio_device *vdev) static void virtblk_remove(struct virtio_device *vdev) { struct virtio_blk *vblk = vdev->priv;...

...}; + struct tun_msg_ctl ctl; size_t len, total_len = 0; int err; struct vhost_net_ubuf_ref *uninitialized_var(ubufs); @@ -664,8 +665,10 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock) ubuf->ctx = nvq->ubufs; ubuf->desc = nvq->upend_idx; refcount_set(&ubuf->refcnt, 1); - msg.msg_control = ubuf; - msg.msg_controllen = sizeof(ubuf); + msg.msg_control = &ctl; + ctl.type = TUN_MSG_UBUF; + ctl.ptr = ubuf; + msg.msg_controllen = sizeof(ctl); ubufs = nvq->ubufs; atomic_inc(&ubufs->refcount); nvq->upend_i...

...+ .open = virtblk_open, > + .release = virtblk_release, > .getgeo = virtblk_getgeo, > }; > > @@ -655,6 +715,10 @@ static int virtblk_probe(struct virtio_device *vdev) > goto out_free_index; > } > > + /* This reference is dropped in virtblk_remove(). */ > + refcount_set(&vblk->refs, 1); > + mutex_init(&vblk->remove_mutex); > + > vblk->vdev = vdev; > vblk->sg_elems = sg_elems; > > @@ -820,8 +884,12 @@ static int virtblk_probe(struct virtio_device *vdev) > static void virtblk_remove(struct virtio_device *vdev) > {...

...,7 @@ static int kvmi_recv_thread(void *arg) */ kvmi_sock_shutdown(kvmi); + kvmi_put(kvmi->kvm); return 0; } @@ -293,9 +319,18 @@ int kvmi_hook(struct kvm *kvm, const struct kvm_introspection_hook *hook) if (err) goto destroy; + init_completion(&kvm->kvmi_complete); + + refcount_set(&kvm->kvmi_ref, 1); + /* + * Paired with refcount_inc_not_zero() from kvmi_get(). + */ + smp_wmb(); + kvmi->recv = kthread_run(kvmi_recv_thread, kvmi, "kvmi-recv"); if (IS_ERR(kvmi->recv)) { err = -ENOMEM; + kvmi_put(kvm); goto unhook; } @@ -616,3 +651,40 @@...

...+ .open = virtblk_open, > + .release = virtblk_release, > .getgeo = virtblk_getgeo, > }; > > @@ -655,6 +721,10 @@ static int virtblk_probe(struct virtio_device *vdev) > goto out_free_index; > } > > + /* This reference is dropped in virtblk_remove(). */ > + refcount_set(&vblk->refs, 1); > + mutex_init(&vblk->vdev_mutex); > + > vblk->vdev = vdev; > vblk->sg_elems = sg_elems; > > @@ -820,8 +890,6 @@ static int virtblk_probe(struct virtio_device *vdev) > static void virtblk_remove(struct virtio_device *vdev) > { &gt...