Lines Matching full:dead

47  * ONEREF   MAXREF               SATURATED             RELEASED      DEAD    NOREF
49  * <---valid --------> <-------saturation zone-------> <-----dead zone----->
55  * If the reference count is saturated or dead, then the increments and
57  * respective zones and is always set back to STATURATED resp. DEAD. The
66  * back to RCUREF_ONEREF or even drop the reference again and mark it DEAD.
69  * DEAD + 1, which is inside the dead zone. If that happens the reference
70  * count is put back to DEAD.
78  *		succeeds->			atomic_cmpxchg(&ref->refcnt, NOREF, DEAD);
80  *	atomic_add_negative(1, &ref->refcnt);	<- Elevates refcount to DEAD + 1
83  * and observes refcnt being in the dead zone which makes the operation fail.
91  *	T2     -1	0		put() tries to mark dead
93  *	T2	0	1		put() mark dead fails
94  *	T1     -1	0		put() tries to mark dead
95  *	T1    DEAD	0		put() mark dead succeeds
96  *	T2    DEAD+1	0		get() fails and puts it back to DEAD
127  *	atomic_cmpxchg(&ref->refcnt, NOREF, DEAD);	<- UAF
149  * the occasional race vs. a dead or already saturated refcount into
150  * account. The saturation and dead zones are large enough to accomodate
174  * object DEAD it also provides acquire ordering.
187  *	False if the reference count was already marked dead
197 	 * If the reference count was already marked dead, undo the  in rcuref_get_slowpath()
198 	 * increment so it stays in the middle of the dead zone and return  in rcuref_get_slowpath()
247 		 * it dead already. Both are valid situations and do not  in rcuref_put_slowpath()
263 	 * If the reference count was already in the dead zone, then this  in rcuref_put_slowpath()
265 	 * DEAD and tell the caller to not deconstruct the object.  in rcuref_put_slowpath()