RDMA/hns: Use refcount_t instead of atomic_t for CQ reference counting

The refcount_t API will WARN on underflow and overflow of a reference
counter, and avoid use-after-free risks.

Link: https://lore.kernel.org/r/1622194663-2383-9-git-send-email-liweihang@huawei.com
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index a5a74b6..1e9c3c5 100644 (file)
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -154,7 +154,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq)
        hr_cq->cons_index = 0;
        hr_cq->arm_sn = 1;
 
-       atomic_set(&hr_cq->refcount, 1);
+       refcount_set(&hr_cq->refcount, 1);
        init_completion(&hr_cq->free);
 
        return 0;
@@ -188,7 +188,7 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq)
        synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq);
 
        /* wait for all interrupt processed */
-       if (atomic_dec_and_test(&hr_cq->refcount))
+       if (refcount_dec_and_test(&hr_cq->refcount))
                complete(&hr_cq->free);
        wait_for_completion(&hr_cq->free);
 
@@ -480,7 +480,7 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type)
                return;
        }
 
-       atomic_inc(&hr_cq->refcount);
+       refcount_inc(&hr_cq->refcount);
 
        ibcq = &hr_cq->ib_cq;
        if (ibcq->event_handler) {
@@ -490,7 +490,7 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type)
                ibcq->event_handler(&event, ibcq->cq_context);
        }
 
-       if (atomic_dec_and_test(&hr_cq->refcount))
+       if (refcount_dec_and_test(&hr_cq->refcount))
                complete(&hr_cq->free);
 }
 

diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
index c6cacd2..cbb6901 100644 (file)
--- a/drivers/infiniband/hw/hns/hns_roce_device.h
+++ b/drivers/infiniband/hw/hns/hns_roce_device.h
@@ -444,7 +444,7 @@ struct hns_roce_cq {
        int                             cqe_size;
        unsigned long                   cqn;
        u32                             vector;
-       atomic_t                        refcount;
+       refcount_t                      refcount;
        struct completion               free;
        struct list_head                sq_list; /* all qps on this send cq */
        struct list_head                rq_list; /* all qps on this recv cq */