iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net, xfrm: convert xfrm_state.refcnt from atomic_t to refcount_t

Browse Source 
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Reshetova, Elena 2017-07-04 15:53:21 +03:00 committed by David S. Miller
parent 5534a51ab7
commit 88755e9c7c
2 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
include/net/xfrm.h
View File

@ -13,6 +13,7 @@
#include <linux/mutex.h>
#include <linux/audit.h>
#include <linux/slab.h>
#include <linux/refcount.h>
#include <net/sock.h>
#include <net/dst.h>
@ -137,7 +138,7 @@ struct xfrm_state {
struct hlist_node bysrc;
struct hlist_node byspi;
atomic_t refcnt;
refcount_t refcnt;
spinlock_t lock;
struct xfrm_id id;
@ -837,18 +838,18 @@ void __xfrm_state_destroy(struct xfrm_state *);
static inline void __xfrm_state_put(struct xfrm_state *x)
{
atomic_dec(&x->refcnt);
refcount_dec(&x->refcnt);
}
static inline void xfrm_state_put(struct xfrm_state *x)
{
if (atomic_dec_and_test(&x->refcnt))
if (refcount_dec_and_test(&x->refcnt))
__xfrm_state_destroy(x);
}
static inline void xfrm_state_hold(struct xfrm_state *x)
{
atomic_inc(&x->refcnt);
refcount_inc(&x->refcnt);
}
static inline bool addr_match(const void *token1, const void *token2,

4
net/xfrm/xfrm_state.c
View File

@ -48,7 +48,7 @@ static HLIST_HEAD(xfrm_state_gc_list);
static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x)
{
return atomic_inc_not_zero(&x->refcnt);
return refcount_inc_not_zero(&x->refcnt);
}
static inline unsigned int xfrm_dst_hash(struct net *net,
@ -558,7 +558,7 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
if (x) {
write_pnet(&x->xs_net, net);
atomic_set(&x->refcnt, 1);
refcount_set(&x->refcnt, 1);
atomic_set(&x->tunnel_users, 0);
INIT_LIST_HEAD(&x->km.all);
INIT_HLIST_NODE(&x->bydst);