lkml.org 
[lkml]   [2017]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 14/16] drivers, net, ppp: convert syncppp.refcnt from atomic_t to refcount_t
    Date
    refcount_t type and corresponding API should be
    used instead of atomic_t when the variable is used as
    a reference counter. This allows to avoid accidental
    refcounter overflows that might lead to use-after-free
    situations.

    Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
    Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: David Windsor <dwindsor@gmail.com>
    ---
    drivers/net/ppp/ppp_synctty.c | 11 ++++++-----
    1 file changed, 6 insertions(+), 5 deletions(-)

    diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
    index 9ae5398..4a643f8 100644
    --- a/drivers/net/ppp/ppp_synctty.c
    +++ b/drivers/net/ppp/ppp_synctty.c
    @@ -46,6 +46,7 @@
    #include <linux/init.h>
    #include <linux/interrupt.h>
    #include <linux/slab.h>
    +#include <linux/refcount.h>
    #include <asm/unaligned.h>
    #include <linux/uaccess.h>

    @@ -72,7 +73,7 @@ struct syncppp {

    struct tasklet_struct tsk;

    - atomic_t refcnt;
    + refcount_t refcnt;
    struct completion dead_cmp;
    struct ppp_channel chan; /* interface to generic ppp layer */
    };
    @@ -141,14 +142,14 @@ static struct syncppp *sp_get(struct tty_struct *tty)
    read_lock(&disc_data_lock);
    ap = tty->disc_data;
    if (ap != NULL)
    - atomic_inc(&ap->refcnt);
    + refcount_inc(&ap->refcnt);
    read_unlock(&disc_data_lock);
    return ap;
    }

    static void sp_put(struct syncppp *ap)
    {
    - if (atomic_dec_and_test(&ap->refcnt))
    + if (refcount_dec_and_test(&ap->refcnt))
    complete(&ap->dead_cmp);
    }

    @@ -182,7 +183,7 @@ ppp_sync_open(struct tty_struct *tty)
    skb_queue_head_init(&ap->rqueue);
    tasklet_init(&ap->tsk, ppp_sync_process, (unsigned long) ap);

    - atomic_set(&ap->refcnt, 1);
    + refcount_set(&ap->refcnt, 1);
    init_completion(&ap->dead_cmp);

    ap->chan.private = ap;
    @@ -232,7 +233,7 @@ ppp_sync_close(struct tty_struct *tty)
    * our channel ops (i.e. ppp_sync_send/ioctl) are in progress
    * by the time it returns.
    */
    - if (!atomic_dec_and_test(&ap->refcnt))
    + if (!refcount_dec_and_test(&ap->refcnt))
    wait_for_completion(&ap->dead_cmp);
    tasklet_kill(&ap->tsk);

    --
    2.7.4
    \
     
     \ /
      Last update: 2017-03-28 11:06    [W:8.643 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site