lp:~mjeanson/+git/userspace-rcu

Author: Mathieu Desnoyers
Author Date: 2016-01-21 16:45:58 UTC

urcu_ref_get_safe: introduce new API

Add a urcu_ref_get_safe API, which returns a boolean. It takes the value
"false" if a LONG_MAX overflow would occur (get is not performed in this
case), or true otherwise.

It warns the user (at compile-time) if the return value is unchecked.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

Author: Mathieu Desnoyers
Author Date: 2016-01-19 20:23:01 UTC

Fix: handle reference count overflow

The urcu refcounting API features a look and feel similar to the Linux
kernel reference counting API, which has been the subject of
CVE-2016-0728 (use-after-free). Therefore, improve the urcu refcounting
API by dealing with reference counting overflow.

For urcu_ref_get(), handle this by comparing the prior value with
LONG_MAX before updating it with a cmpxchg. When an overflow would
occur, trigger a abort() rather than allowing the overflow (which is a
use-after-free security concern).

For urcu_ref_get_unless_zero(), in addition to compare the prior value
to 0, also compare it to LONG_MAX, and return failure (false) in both
cases.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>