1 /* SPDX-License-Identifier: GPL-2.0 */
13  * counter and causing 'spurious' use-after-free issues. In order to avoid the
23  *   +--------------------------------+----------------+----------------+
24  *                                     <---------- bad value! ---------->
44  * With the current PID limit, if no batched refcounting operations are used and
50  *     (UINT_MAX+1-REFCOUNT_SATURATED) / PID_MAX_LIMIT =
55  * given the precise timing details involved with the round-robin scheduling of
82  * because the 1->0 transition indicates no concurrency.
104  * typedef refcount_t - variant of atomic_t specialized for reference counts
109  * use-after-free bugs.
130  * refcount_set - set a refcount's value
136 	atomic_set(&r->refs, n);  in refcount_set()
140  * refcount_read - get a refcount's value
147 	return atomic_read(&r->refs);  in refcount_read()
150 static inline __must_check bool __refcount_add_not_zero(int i, refcount_t *r, int *oldp)  in __refcount_add_not_zero()  argument
157 	} while (!atomic_try_cmpxchg_relaxed(&r->refs, &old, old + i));  in __refcount_add_not_zero()
162 	if (unlikely(old < 0 || old + i < 0))  in __refcount_add_not_zero()
169  * refcount_add_not_zero - add a value to a refcount unless it is 0
170  * @i: the value to add to the refcount
186 static inline __must_check bool refcount_add_not_zero(int i, refcount_t *r)  in refcount_add_not_zero()  argument
188 	return __refcount_add_not_zero(i, r, NULL);  in refcount_add_not_zero()
191 static inline void __refcount_add(int i, refcount_t *r, int *oldp)  in __refcount_add()  argument
193 	int old = atomic_fetch_add_relaxed(i, &r->refs);  in __refcount_add()
200 	else if (unlikely(old < 0 || old + i < 0))  in __refcount_add()
205  * refcount_add - add a value to a refcount
206  * @i: the value to add to the refcount
220 static inline void refcount_add(int i, refcount_t *r)  in refcount_add()  argument
222 	__refcount_add(i, r, NULL);  in refcount_add()
231  * refcount_inc_not_zero - increment a refcount unless it is 0
254  * refcount_inc - increment a refcount
262  * Will WARN if the refcount is 0, as this represents a possible use-after-free
270 static inline __must_check bool __refcount_sub_and_test(int i, refcount_t *r, int *oldp)  in __refcount_sub_and_test()  argument
272 	int old = atomic_fetch_sub_release(i, &r->refs);  in __refcount_sub_and_test()
277 	if (old == i) {  in __refcount_sub_and_test()
282 	if (unlikely(old < 0 || old - i < 0))  in __refcount_sub_and_test()
289  * refcount_sub_and_test - subtract from a refcount and test if it is 0
290  * @i: amount to subtract from the refcount
294  * ultimately leak on underflow and will fail to decrement when saturated
308 static inline __must_check bool refcount_sub_and_test(int i, refcount_t *r)  in refcount_sub_and_test()  argument
310 	return __refcount_sub_and_test(i, r, NULL);  in refcount_sub_and_test()
319  * refcount_dec_and_test - decrement a refcount and test if it is 0
338 	int old = atomic_fetch_sub_release(1, &r->refs);  in __refcount_dec()
348  * refcount_dec - decrement a refcount