[Devel] [PATCH VZ9 1/4] fs/fuse kio: do not allow getting cslist when refcnt is equal to 0

[Yuriy Vasilev]

When the refcnt of a cslist is equal to 0, it indicates that the cslist
has been dropped and is going to be freed. In such cases, let's trigger
a BUG_ON to prevent use after free.

https://pmc.acronis.work/browse/VSTOR-76384

Signed-off-by: Yuriy Vasilev <yuriy.vasilev at virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_map.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/kio/pcs/pcs_map.h b/fs/fuse/kio/pcs/pcs_map.h
index f990c9f9defa..cadc106d45c1 100644
--- a/fs/fuse/kio/pcs/pcs_map.h
+++ b/fs/fuse/kio/pcs/pcs_map.h
@@ -236,7 +236,7 @@ static inline void cslist_get(struct pcs_cs_list * csl)
 {
 	TRACE("csl:%p csl->map:%p refcnt:%d\n", csl, csl->map, atomic_read(&csl->refcnt));
 
-	atomic_inc(&csl->refcnt);
+	BUG_ON(!atomic_inc_not_zero(&csl->refcnt));
 }
 
 static inline void cslist_put(struct pcs_cs_list * csl)
-- 
2.34.1