net, sunrpc: convert gss_cl_ctx.count from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
156be7edc8
commit
0fa104726b
|
@ -13,6 +13,7 @@
|
|||
#define _LINUX_SUNRPC_AUTH_GSS_H
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include <linux/refcount.h>
|
||||
#include <linux/sunrpc/auth.h>
|
||||
#include <linux/sunrpc/svc.h>
|
||||
#include <linux/sunrpc/gss_api.h>
|
||||
|
@ -65,7 +66,7 @@ struct rpc_gss_init_res {
|
|||
* the wire when communicating with a server. */
|
||||
|
||||
struct gss_cl_ctx {
|
||||
atomic_t count;
|
||||
refcount_t count;
|
||||
enum rpc_gss_proc gc_proc;
|
||||
u32 gc_seq;
|
||||
spinlock_t gc_seq_lock;
|
||||
|
|
|
@ -117,14 +117,14 @@ static const struct rpc_pipe_ops gss_upcall_ops_v1;
|
|||
static inline struct gss_cl_ctx *
|
||||
gss_get_ctx(struct gss_cl_ctx *ctx)
|
||||
{
|
||||
atomic_inc(&ctx->count);
|
||||
refcount_inc(&ctx->count);
|
||||
return ctx;
|
||||
}
|
||||
|
||||
static inline void
|
||||
gss_put_ctx(struct gss_cl_ctx *ctx)
|
||||
{
|
||||
if (atomic_dec_and_test(&ctx->count))
|
||||
if (refcount_dec_and_test(&ctx->count))
|
||||
gss_free_ctx(ctx);
|
||||
}
|
||||
|
||||
|
@ -200,7 +200,7 @@ gss_alloc_context(void)
|
|||
ctx->gc_proc = RPC_GSS_PROC_DATA;
|
||||
ctx->gc_seq = 1; /* NetApp 6.4R1 doesn't accept seq. no. 0 */
|
||||
spin_lock_init(&ctx->gc_seq_lock);
|
||||
atomic_set(&ctx->count,1);
|
||||
refcount_set(&ctx->count,1);
|
||||
}
|
||||
return ctx;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue