diff options
| author | Kees Cook <keescook@chromium.org> | 2017-06-26 09:24:00 -0700 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2017-06-26 09:24:00 -0700 |
| commit | 0b5fa2290637a3235898d18dc0e7a136783f1bd2 (patch) | |
| tree | fa350a4ac455aace74b1aa5b584a1f9afef8e770 | |
| parent | 93bd70e3330be45542c455dde11d8dc657ab3044 (diff) | |
| download | linux-0b5fa2290637a3235898d18dc0e7a136783f1bd2.tar.gz linux-0b5fa2290637a3235898d18dc0e7a136783f1bd2.tar.bz2 linux-0b5fa2290637a3235898d18dc0e7a136783f1bd2.zip | |
seccomp: Switch from atomic_t to recount_t
This switches the seccomp usage tracking from atomic_t to refcount_t to
gain refcount overflow protections.
Cc: Elena Reshetova <elena.reshetova@intel.com>
Cc: David Windsor <dwindsor@gmail.com>
Cc: Hans Liljestrand <hans.liljestrand@aalto.fi>
Signed-off-by: Kees Cook <keescook@chromium.org>
| -rw-r--r-- | kernel/seccomp.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/kernel/seccomp.c b/kernel/seccomp.c index fce83885b7ef..98b59b5db90b 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -13,7 +13,7 @@ * of Berkeley Packet Filters/Linux Socket Filters. */ -#include <linux/atomic.h> +#include <linux/refcount.h> #include <linux/audit.h> #include <linux/compat.h> #include <linux/coredump.h> @@ -56,7 +56,7 @@ * to a task_struct (other than @usage). */ struct seccomp_filter { - atomic_t usage; + refcount_t usage; struct seccomp_filter *prev; struct bpf_prog *prog; }; @@ -378,7 +378,7 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) return ERR_PTR(ret); } - atomic_set(&sfilter->usage, 1); + refcount_set(&sfilter->usage, 1); return sfilter; } @@ -465,7 +465,7 @@ void get_seccomp_filter(struct task_struct *tsk) if (!orig) return; /* Reference count is bounded by the number of total processes. */ - atomic_inc(&orig->usage); + refcount_inc(&orig->usage); } static inline void seccomp_filter_free(struct seccomp_filter *filter) @@ -481,7 +481,7 @@ void put_seccomp_filter(struct task_struct *tsk) { struct seccomp_filter *orig = tsk->seccomp.filter; /* Clean up single-reference branches iteratively. */ - while (orig && atomic_dec_and_test(&orig->usage)) { + while (orig && refcount_dec_and_test(&orig->usage)) { struct seccomp_filter *freeme = orig; orig = orig->prev; seccomp_filter_free(freeme); |