diff options
| author | Reshetova, Elena <elena.reshetova@intel.com> | 2017-07-04 15:53:03 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-07-04 22:35:16 +0100 |
| commit | 937149125448290c5d60da2816556409287750ea (patch) | |
| tree | 690fad95131beb68ac8b3561e4485ae09f42487f /net/atm | |
| parent | 788936641ac8bc92c531f09b79bf44775fac1350 (diff) | |
| download | linux-stable-937149125448290c5d60da2816556409287750ea.tar.gz linux-stable-937149125448290c5d60da2816556409287750ea.tar.bz2 linux-stable-937149125448290c5d60da2816556409287750ea.zip | |
net, atm: convert in_cache_entry.use from atomic_t to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/atm')
| -rw-r--r-- | net/atm/mpoa_caches.c | 12 | ||||
| -rw-r--r-- | net/atm/mpoa_caches.h | 3 |
2 files changed, 8 insertions, 7 deletions
diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c index a89fdebeffda..05e89e9930d5 100644 --- a/net/atm/mpoa_caches.c +++ b/net/atm/mpoa_caches.c @@ -40,7 +40,7 @@ static in_cache_entry *in_cache_get(__be32 dst_ip, entry = client->in_cache; while (entry != NULL) { if (entry->ctrl_info.in_dst_ip == dst_ip) { - atomic_inc(&entry->use); + refcount_inc(&entry->use); read_unlock_bh(&client->ingress_lock); return entry; } @@ -61,7 +61,7 @@ static in_cache_entry *in_cache_get_with_mask(__be32 dst_ip, entry = client->in_cache; while (entry != NULL) { if ((entry->ctrl_info.in_dst_ip & mask) == (dst_ip & mask)) { - atomic_inc(&entry->use); + refcount_inc(&entry->use); read_unlock_bh(&client->ingress_lock); return entry; } @@ -82,7 +82,7 @@ static in_cache_entry *in_cache_get_by_vcc(struct atm_vcc *vcc, entry = client->in_cache; while (entry != NULL) { if (entry->shortcut == vcc) { - atomic_inc(&entry->use); + refcount_inc(&entry->use); read_unlock_bh(&client->ingress_lock); return entry; } @@ -105,7 +105,7 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip, dprintk("adding an ingress entry, ip = %pI4\n", &dst_ip); - atomic_set(&entry->use, 1); + refcount_set(&entry->use, 1); dprintk("new_in_cache_entry: about to lock\n"); write_lock_bh(&client->ingress_lock); entry->next = client->in_cache; @@ -121,7 +121,7 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip, entry->count = 1; entry->entry_state = INGRESS_INVALID; entry->ctrl_info.holding_time = HOLDING_TIME_DEFAULT; - atomic_inc(&entry->use); + refcount_inc(&entry->use); write_unlock_bh(&client->ingress_lock); dprintk("new_in_cache_entry: unlocked\n"); @@ -178,7 +178,7 @@ static int cache_hit(in_cache_entry *entry, struct mpoa_client *mpc) static void in_cache_put(in_cache_entry *entry) { - if (atomic_dec_and_test(&entry->use)) { + if (refcount_dec_and_test(&entry->use)) { memset(entry, 0, sizeof(in_cache_entry)); kfree(entry); } diff --git a/net/atm/mpoa_caches.h b/net/atm/mpoa_caches.h index 8e5f78cf0be1..38a4e7e67c0b 100644 --- a/net/atm/mpoa_caches.h +++ b/net/atm/mpoa_caches.h @@ -6,6 +6,7 @@ #include <linux/atm.h> #include <linux/atmdev.h> #include <linux/atmmpc.h> +#include <linux/refcount.h> struct mpoa_client; @@ -25,7 +26,7 @@ typedef struct in_cache_entry { struct atm_vcc *shortcut; uint8_t MPS_ctrl_ATM_addr[ATM_ESA_LEN]; struct in_ctrl_info ctrl_info; - atomic_t use; + refcount_t use; } in_cache_entry; struct in_cache_ops{ |