lkml.org 
[lkml]   [2017]   [Jul]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 31/36] net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t
    Date
    refcount_t type and corresponding API should be
    used instead of atomic_t when the variable is used as
    a reference counter. This allows to avoid accidental
    refcounter overflows that might lead to use-after-free
    situations.

    Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
    Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: David Windsor <dwindsor@gmail.com>
    ---
    include/net/sctp/structs.h | 2 +-
    net/sctp/sm_make_chunk.c | 6 +++---
    2 files changed, 4 insertions(+), 4 deletions(-)

    diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
    index 4d7c855..0dfc5c1 100644
    --- a/include/net/sctp/structs.h
    +++ b/include/net/sctp/structs.h
    @@ -524,7 +524,7 @@ int sctp_chunk_abandoned(struct sctp_chunk *);
    struct sctp_chunk {
    struct list_head list;

    - atomic_t refcnt;
    + refcount_t refcnt;

    /* How many times this chunk have been sent, for prsctp RTX policy */
    int sent_count;
    diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
    index 3af4dd0..4e16b02 100644
    --- a/net/sctp/sm_make_chunk.c
    +++ b/net/sctp/sm_make_chunk.c
    @@ -1345,7 +1345,7 @@ struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
    INIT_LIST_HEAD(&retval->transmitted_list);
    INIT_LIST_HEAD(&retval->frag_list);
    SCTP_DBG_OBJCNT_INC(chunk);
    - atomic_set(&retval->refcnt, 1);
    + refcount_set(&retval->refcnt, 1);

    nodata:
    return retval;
    @@ -1458,13 +1458,13 @@ void sctp_chunk_free(struct sctp_chunk *chunk)
    /* Grab a reference to the chunk. */
    void sctp_chunk_hold(struct sctp_chunk *ch)
    {
    - atomic_inc(&ch->refcnt);
    + refcount_inc(&ch->refcnt);
    }

    /* Release a reference to the chunk. */
    void sctp_chunk_put(struct sctp_chunk *ch)
    {
    - if (atomic_dec_and_test(&ch->refcnt))
    + if (refcount_dec_and_test(&ch->refcnt))
    sctp_chunk_destroy(ch);
    }

    --
    2.7.4
    \
     
     \ /
      Last update: 2017-07-04 15:01    [W:4.504 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site