Pull percpu fix from Tejun Heo: "Douglas found and fixed a ref leak bug in percpu_ref_tryget[_live](). The bug is caused by storing the return value of atomic_long_inc_not_zero() into an int temp variable before returning it as a bool. The interim cast to int loses the upper bits and can lead to false negatives. As percpu_ref uses a high bit to mark a draining counter, this can happen relatively easily. Fixed by using bool for the temp variable" * 'for-4.10-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: percpu-refcount: fix reference leak during percpu-atomic transition
Showing the changes to include (1 of 1 file). Show all
Unified · Split
| @@ -204,7 +204,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref) · 203 unmodified lines | |||
| 204 | static inline bool percpu_ref_tryget(struct percpu_ref *ref) | 204 | static inline bool percpu_ref_tryget(struct percpu_ref *ref) |
| 205 | { | 205 | { |
| 206 | unsigned long __percpu *percpu_count; | 206 | unsigned long __percpu *percpu_count; |
| 207 | int ret; | 207 | bool ret; |
| 208 | 208 | ||
| 209 | rcu_read_lock_sched(); | 209 | rcu_read_lock_sched(); |
| 210 | 210 | ||
| @@ -238,7 +238,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref) · 27 unmodified lines | |||
| 238 | static inline bool percpu_ref_tryget_live(struct percpu_ref *ref) | 238 | static inline bool percpu_ref_tryget_live(struct percpu_ref *ref) |
| 239 | { | 239 | { |
| 240 | unsigned long __percpu *percpu_count; | 240 | unsigned long __percpu *percpu_count; |
| 241 | int ret = false; | 241 | bool ret = false; |
| 242 | 242 | ||
| 243 | rcu_read_lock_sched(); | 243 | rcu_read_lock_sched(); |
| 244 | 244 | ||