net, ax25: convert ax25_uid_assoc.refcount from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>zero-colors
parent
c638457a7c
commit
07f2282fc6
|
@ -11,7 +11,7 @@
|
||||||
#include <linux/timer.h>
|
#include <linux/timer.h>
|
||||||
#include <linux/list.h>
|
#include <linux/list.h>
|
||||||
#include <linux/slab.h>
|
#include <linux/slab.h>
|
||||||
#include <linux/atomic.h>
|
#include <linux/refcount.h>
|
||||||
#include <net/neighbour.h>
|
#include <net/neighbour.h>
|
||||||
#include <net/sock.h>
|
#include <net/sock.h>
|
||||||
|
|
||||||
|
@ -158,7 +158,7 @@ enum {
|
||||||
|
|
||||||
typedef struct ax25_uid_assoc {
|
typedef struct ax25_uid_assoc {
|
||||||
struct hlist_node uid_node;
|
struct hlist_node uid_node;
|
||||||
atomic_t refcount;
|
refcount_t refcount;
|
||||||
kuid_t uid;
|
kuid_t uid;
|
||||||
ax25_address call;
|
ax25_address call;
|
||||||
} ax25_uid_assoc;
|
} ax25_uid_assoc;
|
||||||
|
@ -167,11 +167,11 @@ typedef struct ax25_uid_assoc {
|
||||||
hlist_for_each_entry(__ax25, list, uid_node)
|
hlist_for_each_entry(__ax25, list, uid_node)
|
||||||
|
|
||||||
#define ax25_uid_hold(ax25) \
|
#define ax25_uid_hold(ax25) \
|
||||||
atomic_inc(&((ax25)->refcount))
|
refcount_inc(&((ax25)->refcount))
|
||||||
|
|
||||||
static inline void ax25_uid_put(ax25_uid_assoc *assoc)
|
static inline void ax25_uid_put(ax25_uid_assoc *assoc)
|
||||||
{
|
{
|
||||||
if (atomic_dec_and_test(&assoc->refcount)) {
|
if (refcount_dec_and_test(&assoc->refcount)) {
|
||||||
kfree(assoc);
|
kfree(assoc);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -107,7 +107,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
|
||||||
if ((ax25_uid = kmalloc(sizeof(*ax25_uid), GFP_KERNEL)) == NULL)
|
if ((ax25_uid = kmalloc(sizeof(*ax25_uid), GFP_KERNEL)) == NULL)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
|
||||||
atomic_set(&ax25_uid->refcount, 1);
|
refcount_set(&ax25_uid->refcount, 1);
|
||||||
ax25_uid->uid = sax25_kuid;
|
ax25_uid->uid = sax25_kuid;
|
||||||
ax25_uid->call = sax->sax25_call;
|
ax25_uid->call = sax->sax25_call;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue