diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-20 12:43:05 -1000 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-20 12:43:05 -1000 |
| commit | 776bb6df3f16ab68c40a97dbb8af26af4185d7c0 (patch) | |
| tree | f5006a1e8d28e47201865a7979e41befa2f3e59a /lib | |
| parent | cb95904b470d2d347012d5e360303cf478ca5362 (diff) | |
| parent | 67e0eadd862616cb22145d6117b79b79c4ae48fe (diff) | |
Merge tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
- In the refcount checking code, BUG() on UAF related errors if
CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
- Add {over,under}flow detection for local_interrupt_{enable,disable}()
(Boqun Feng)
- Add kunit test case for max local_interrupt_disable() nesting level
(Boqun Feng)
- Clarify comment (Boqun Feng)
* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irq: Add max local_interrupt_disable() nesting level kunit test case
irq: Explain better on NMI_MASK overflow condition
irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/refcount.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/lib/refcount.c b/lib/refcount.c index a207a8f22b3c..c0f0dc5296eb 100644 --- a/lib/refcount.c +++ b/lib/refcount.c @@ -10,6 +10,15 @@ #define REFCOUNT_WARN(str) WARN_ONCE(1, "refcount_t: " str ".\n") +#ifdef CONFIG_BUG_ON_DATA_CORRUPTION +#define REFCOUNT_CORRUPTION(str) ({ \ + pr_err("refcount_t: " str ".\n"); \ + BUG(); \ +}) +#else +#define REFCOUNT_CORRUPTION(str) REFCOUNT_WARN(str) +#endif + void refcount_warn_saturate(refcount_t *r, enum refcount_saturation_type t) { refcount_set(r, REFCOUNT_SATURATED); @@ -22,10 +31,10 @@ void refcount_warn_saturate(refcount_t *r, enum refcount_saturation_type t) REFCOUNT_WARN("saturated; leaking memory"); break; case REFCOUNT_ADD_UAF: - REFCOUNT_WARN("addition on 0; use-after-free"); + REFCOUNT_CORRUPTION("addition on 0; use-after-free"); break; case REFCOUNT_SUB_UAF: - REFCOUNT_WARN("underflow; use-after-free"); + REFCOUNT_CORRUPTION("underflow; use-after-free"); break; case REFCOUNT_DEC_LEAK: REFCOUNT_WARN("decrement hit 0; leaking memory"); @@ -84,7 +93,7 @@ bool refcount_dec_not_one(refcount_t *r) new = val - 1; if (new > val) { - WARN_ONCE(new > val, "refcount_t: underflow; use-after-free.\n"); + REFCOUNT_CORRUPTION("underflow; use-after-free"); return true; } |