Commit 387ad967 authored by Elena Reshetova's avatar Elena Reshetova Committed by Tejun Heo

kernel: convert cgroup_namespace.count from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent c1ae3cfa
...@@ -22,6 +22,7 @@ ...@@ -22,6 +22,7 @@
#include <linux/ns_common.h> #include <linux/ns_common.h>
#include <linux/nsproxy.h> #include <linux/nsproxy.h>
#include <linux/user_namespace.h> #include <linux/user_namespace.h>
#include <linux/refcount.h>
#include <linux/cgroup-defs.h> #include <linux/cgroup-defs.h>
...@@ -640,7 +641,7 @@ static inline void cgroup_sk_free(struct sock_cgroup_data *skcd) {} ...@@ -640,7 +641,7 @@ static inline void cgroup_sk_free(struct sock_cgroup_data *skcd) {}
#endif /* CONFIG_CGROUP_DATA */ #endif /* CONFIG_CGROUP_DATA */
struct cgroup_namespace { struct cgroup_namespace {
atomic_t count; refcount_t count;
struct ns_common ns; struct ns_common ns;
struct user_namespace *user_ns; struct user_namespace *user_ns;
struct ucounts *ucounts; struct ucounts *ucounts;
...@@ -675,12 +676,12 @@ copy_cgroup_ns(unsigned long flags, struct user_namespace *user_ns, ...@@ -675,12 +676,12 @@ copy_cgroup_ns(unsigned long flags, struct user_namespace *user_ns,
static inline void get_cgroup_ns(struct cgroup_namespace *ns) static inline void get_cgroup_ns(struct cgroup_namespace *ns)
{ {
if (ns) if (ns)
atomic_inc(&ns->count); refcount_inc(&ns->count);
} }
static inline void put_cgroup_ns(struct cgroup_namespace *ns) static inline void put_cgroup_ns(struct cgroup_namespace *ns)
{ {
if (ns && atomic_dec_and_test(&ns->count)) if (ns && refcount_dec_and_test(&ns->count))
free_cgroup_ns(ns); free_cgroup_ns(ns);
} }
......
...@@ -189,7 +189,7 @@ static u16 have_canfork_callback __read_mostly; ...@@ -189,7 +189,7 @@ static u16 have_canfork_callback __read_mostly;
/* cgroup namespace for init task */ /* cgroup namespace for init task */
struct cgroup_namespace init_cgroup_ns = { struct cgroup_namespace init_cgroup_ns = {
.count = { .counter = 2, }, .count = REFCOUNT_INIT(2),
.user_ns = &init_user_ns, .user_ns = &init_user_ns,
.ns.ops = &cgroupns_operations, .ns.ops = &cgroupns_operations,
.ns.inum = PROC_CGROUP_INIT_INO, .ns.inum = PROC_CGROUP_INIT_INO,
......
...@@ -31,7 +31,7 @@ static struct cgroup_namespace *alloc_cgroup_ns(void) ...@@ -31,7 +31,7 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
kfree(new_ns); kfree(new_ns);
return ERR_PTR(ret); return ERR_PTR(ret);
} }
atomic_set(&new_ns->count, 1); refcount_set(&new_ns->count, 1);
new_ns->ns.ops = &cgroupns_operations; new_ns->ns.ops = &cgroupns_operations;
return new_ns; return new_ns;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment