Lines Matching refs:refcnt
16 * if (p && !atomic_inc_not_zero(&p->refcnt))
22 * if (!atomic_dec_return(&->refcnt)) {
77 * if (atomic_add_negative(-1, &ref->refcnt))
78 * succeeds-> atomic_cmpxchg(&ref->refcnt, NOREF, DEAD);
80 * atomic_add_negative(1, &ref->refcnt); <- Elevates refcount to DEAD + 1
83 * and observes refcnt being in the dead zone which makes the operation fail.
110 * // ref->refcnt = ONEREF
111 * if (!atomic_add_negative(-1, &ref->refcnt))
114 * // ref->refcnt == NOREF
116 * // Elevates ref->refcnt to ONEREF
117 * if (!atomic_add_negative(1, &ref->refcnt))
127 * atomic_cmpxchg(&ref->refcnt, NOREF, DEAD); <- UAF
194 unsigned int cnt = atomic_read(&ref->refcnt);
202 atomic_set(&ref->refcnt, RCUREF_DEAD);
215 atomic_set(&ref->refcnt, RCUREF_SATURATED);
238 unsigned int cnt = atomic_read(&ref->refcnt);
251 if (atomic_cmpxchg_release(&ref->refcnt, RCUREF_NOREF, RCUREF_DEAD) != RCUREF_NOREF)
268 atomic_set(&ref->refcnt, RCUREF_DEAD);
278 atomic_set(&ref->refcnt, RCUREF_SATURATED);