Commit e65f7ee3 authored by Elena Reshetova's avatar Elena Reshetova Committed by David S. Miller

drivers, connector: convert cn_callback_entry.refcnt from atomic_t to refcount_t

atomic_t variables are currently used to implement reference
counters with the following properties:
 - counter is initialized to 1 using atomic_set()
 - a resource is freed upon counter reaching zero
 - once counter reaches zero, its further
   increments aren't allowed
 - counter schema uses basic atomic operations
   (set, inc, inc_not_zero, dec_and_test, etc.)

Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.

The variable cn_callback_entry.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.
Suggested-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarDavid Windsor <dwindsor@gmail.com>
Reviewed-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 709c89b4
...@@ -45,7 +45,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const char *name, ...@@ -45,7 +45,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const char *name,
return NULL; return NULL;
} }
atomic_set(&cbq->refcnt, 1); refcount_set(&cbq->refcnt, 1);
atomic_inc(&dev->refcnt); atomic_inc(&dev->refcnt);
cbq->pdev = dev; cbq->pdev = dev;
...@@ -58,7 +58,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const char *name, ...@@ -58,7 +58,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const char *name,
void cn_queue_release_callback(struct cn_callback_entry *cbq) void cn_queue_release_callback(struct cn_callback_entry *cbq)
{ {
if (!atomic_dec_and_test(&cbq->refcnt)) if (!refcount_dec_and_test(&cbq->refcnt))
return; return;
atomic_dec(&cbq->pdev->refcnt); atomic_dec(&cbq->pdev->refcnt);
......
...@@ -157,7 +157,7 @@ static int cn_call_callback(struct sk_buff *skb) ...@@ -157,7 +157,7 @@ static int cn_call_callback(struct sk_buff *skb)
spin_lock_bh(&dev->cbdev->queue_lock); spin_lock_bh(&dev->cbdev->queue_lock);
list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) { list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) {
if (cn_cb_equal(&i->id.id, &msg->id)) { if (cn_cb_equal(&i->id.id, &msg->id)) {
atomic_inc(&i->refcnt); refcount_inc(&i->refcnt);
cbq = i; cbq = i;
break; break;
} }
......
...@@ -22,7 +22,7 @@ ...@@ -22,7 +22,7 @@
#define __CONNECTOR_H #define __CONNECTOR_H
#include <linux/atomic.h> #include <linux/refcount.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/workqueue.h> #include <linux/workqueue.h>
...@@ -49,7 +49,7 @@ struct cn_callback_id { ...@@ -49,7 +49,7 @@ struct cn_callback_id {
struct cn_callback_entry { struct cn_callback_entry {
struct list_head callback_entry; struct list_head callback_entry;
atomic_t refcnt; refcount_t refcnt;
struct cn_queue_dev *pdev; struct cn_queue_dev *pdev;
struct cn_callback_id id; struct cn_callback_id id;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment