On Wed, Sep 23, 2020 at 07:10:27AM +0200, Greg KH wrote: > On Tue, Sep 22, 2020 at 07:43:36PM -0600, Shuah Khan wrote: > > counter_atomic is introduced to be used when a variable is used as > > a simple counter and doesn't guard object lifetimes. This clearly > > differentiates atomic_t usages that guard object lifetimes. > > > > counter_atomic variables will wrap around to 0 when it overflows and > > should not be used to guard resource lifetimes, device usage and > > open counts that control state changes, and pm states. > > > > stats tracks per-process binder statistics. Unsure if there is a chance > > of this overflowing, other than stats getting reset to 0. Convert it to > > use counter_atomic. > > > > binder_transaction_log:cur is used to keep track of the current log entry > > location. Overflow is handled in the code. Since it is used as a > > counter, convert it to use counter_atomic. > > > > This conversion doesn't change the oveflow wrap around behavior. > > > > Signed-off-by: Shuah Khan <sk...@linuxfoundation.org> > > --- > > drivers/android/binder.c | 41 ++++++++++++++++--------------- > > drivers/android/binder_internal.h | 3 ++- > > 2 files changed, 23 insertions(+), 21 deletions(-) > > > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > > index f936530a19b0..11a0407c46df 100644 > > --- a/drivers/android/binder.c > > +++ b/drivers/android/binder.c > > @@ -66,6 +66,7 @@ > > #include <linux/syscalls.h> > > #include <linux/task_work.h> > > #include <linux/sizes.h> > > +#include <linux/counters.h> > > > > #include <uapi/linux/android/binder.h> > > #include <uapi/linux/android/binderfs.h> > > @@ -172,22 +173,22 @@ enum binder_stat_types { > > }; > > > > struct binder_stats { > > - atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1]; > > - atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1]; > > - atomic_t obj_created[BINDER_STAT_COUNT]; > > - atomic_t obj_deleted[BINDER_STAT_COUNT]; > > + struct counter_atomic br[_IOC_NR(BR_FAILED_REPLY) + 1]; > > + struct counter_atomic bc[_IOC_NR(BC_REPLY_SG) + 1]; > > + struct counter_atomic obj_created[BINDER_STAT_COUNT]; > > + struct counter_atomic obj_deleted[BINDER_STAT_COUNT]; > > These are just debugging statistics, no reason they have to be atomic > variables at all and they should be able to just be "struct counter" > variables instead.
But there's no reason for them _not_ to be atomic. Please let's keep this API as always safe. Why even provide a new foot-gun here? -- Kees Cook