Messages in this thread | | | From | Kees Cook <> | Date | Sat, 27 May 2017 12:41:47 -0700 | Subject | Re: [PATCH 1/3] ipc: convert ipc_namespace.count from atomic_t to refcount_t |
| |
On Mon, Feb 20, 2017 at 3:29 AM, Elena Reshetova <elena.reshetova@intel.com> wrote: > refcount_t type and corresponding API should be > used instead of atomic_t when the variable is used as > a reference counter. This allows to avoid accidental > refcounter overflows that might lead to use-after-free > situations. > > Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> > Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> > Signed-off-by: Kees Cook <keescook@chromium.org> > Signed-off-by: David Windsor <dwindsor@gmail.com>
Manfred, is this okay by you? I think this should go via -mm...
-Kees
> --- > include/linux/ipc_namespace.h | 5 +++-- > ipc/msgutil.c | 2 +- > ipc/namespace.c | 4 ++-- > 3 files changed, 6 insertions(+), 5 deletions(-) > > diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h > index 848e579..7230638 100644 > --- a/include/linux/ipc_namespace.h > +++ b/include/linux/ipc_namespace.h > @@ -7,6 +7,7 @@ > #include <linux/notifier.h> > #include <linux/nsproxy.h> > #include <linux/ns_common.h> > +#include <linux/refcount.h> > > struct user_namespace; > > @@ -19,7 +20,7 @@ struct ipc_ids { > }; > > struct ipc_namespace { > - atomic_t count; > + refcount_t count; > struct ipc_ids ids[3]; > > int sem_ctls[4]; > @@ -118,7 +119,7 @@ extern struct ipc_namespace *copy_ipcs(unsigned long flags, > static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns) > { > if (ns) > - atomic_inc(&ns->count); > + refcount_inc(&ns->count); > return ns; > } > > diff --git a/ipc/msgutil.c b/ipc/msgutil.c > index bf74eaa..8459802 100644 > --- a/ipc/msgutil.c > +++ b/ipc/msgutil.c > @@ -29,7 +29,7 @@ DEFINE_SPINLOCK(mq_lock); > * and not CONFIG_IPC_NS. > */ > struct ipc_namespace init_ipc_ns = { > - .count = ATOMIC_INIT(1), > + .count = REFCOUNT_INIT(1), > .user_ns = &init_user_ns, > .ns.inum = PROC_IPC_INIT_INO, > #ifdef CONFIG_IPC_NS > diff --git a/ipc/namespace.c b/ipc/namespace.c > index 0abdea4..ed10bbc 100644 > --- a/ipc/namespace.c > +++ b/ipc/namespace.c > @@ -48,7 +48,7 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns, > goto fail_free; > ns->ns.ops = &ipcns_operations; > > - atomic_set(&ns->count, 1); > + refcount_set(&ns->count, 1); > ns->user_ns = get_user_ns(user_ns); > ns->ucounts = ucounts; > > @@ -142,7 +142,7 @@ static void free_ipc_ns(struct ipc_namespace *ns) > */ > void put_ipc_ns(struct ipc_namespace *ns) > { > - if (atomic_dec_and_lock(&ns->count, &mq_lock)) { > + if (refcount_dec_and_lock(&ns->count, &mq_lock)) { > mq_clear_sbinfo(ns); > spin_unlock(&mq_lock); > mq_put_mnt(ns); > -- > 2.7.4 >
-- Kees Cook Pixel Security
| |