lkml.org 
[lkml]   [2017]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 03/17] net: convert neigh_params.refcnt from atomic_t to refcount_t
    Date
    refcount_t type and corresponding API should be
    used instead of atomic_t when the variable is used as
    a reference counter. This allows to avoid accidental
    refcounter overflows that might lead to use-after-free
    situations.

    Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
    Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: David Windsor <dwindsor@gmail.com>
    ---
    include/net/neighbour.h | 6 +++---
    net/core/neighbour.c | 8 ++++----
    2 files changed, 7 insertions(+), 7 deletions(-)

    diff --git a/include/net/neighbour.h b/include/net/neighbour.h
    index e5ee739..afc39e3 100644
    --- a/include/net/neighbour.h
    +++ b/include/net/neighbour.h
    @@ -77,7 +77,7 @@ struct neigh_parms {
    void *sysctl_table;

    int dead;
    - atomic_t refcnt;
    + refcount_t refcnt;
    struct rcu_head rcu_head;

    int reachable_time;
    @@ -396,12 +396,12 @@ void neigh_sysctl_unregister(struct neigh_parms *p);

    static inline void __neigh_parms_put(struct neigh_parms *parms)
    {
    - atomic_dec(&parms->refcnt);
    + refcount_dec(&parms->refcnt);
    }

    static inline struct neigh_parms *neigh_parms_clone(struct neigh_parms *parms)
    {
    - atomic_inc(&parms->refcnt);
    + refcount_inc(&parms->refcnt);
    return parms;
    }

    diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    index 0c78c8e..e31fc11 100644
    --- a/net/core/neighbour.c
    +++ b/net/core/neighbour.c
    @@ -709,7 +709,7 @@ static void neigh_parms_destroy(struct neigh_parms *parms);

    static inline void neigh_parms_put(struct neigh_parms *parms)
    {
    - if (atomic_dec_and_test(&parms->refcnt))
    + if (refcount_dec_and_test(&parms->refcnt))
    neigh_parms_destroy(parms);
    }

    @@ -1479,7 +1479,7 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
    p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
    if (p) {
    p->tbl = tbl;
    - atomic_set(&p->refcnt, 1);
    + refcount_set(&p->refcnt, 1);
    p->reachable_time =
    neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
    dev_hold(dev);
    @@ -1542,7 +1542,7 @@ void neigh_table_init(int index, struct neigh_table *tbl)
    INIT_LIST_HEAD(&tbl->parms_list);
    list_add(&tbl->parms.list, &tbl->parms_list);
    write_pnet(&tbl->parms.net, &init_net);
    - atomic_set(&tbl->parms.refcnt, 1);
    + refcount_set(&tbl->parms.refcnt, 1);
    tbl->parms.reachable_time =
    neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));

    @@ -1796,7 +1796,7 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)

    if ((parms->dev &&
    nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
    - nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
    + nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
    nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
    NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
    /* approximative value for deprecated QUEUE_LEN (in packets) */
    --
    2.7.4
    \
     
     \ /
      Last update: 2017-06-30 23:11    [W:3.850 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site