From: Elena Reshetova <elena.reshetova@intel.com> To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, davem@davemloft.net, jmorris@namei.org, kaber@trash.net, yoshfuji@linux-ipv6.org, kuznet@ms2.inr.ac.ru, 3chas3@gmail.com, ralf@linux-mips.org, stephen@networkplumber.org, jchapman@katalix.com, jhs@mojatatu.com, bridge@lists.linux-foundation.org, linux-hams@vger.kernel.org, linux-x25@vger.kernel.org, linux-bluetooth@vger.kernel.org, marcel@holtmann.org, johan.hedberg@gmail.com, peterz@infradead.org, keescook@chromium.org, Elena Reshetova <elena.reshetova@intel.com>, Hans Liljestrand <ishkamiel@gmail.com>, David Windsor <dwindsor@gmail.com> Subject: [PATCH 15/18] net, ipx: convert ipx_interface.refcnt from atomic_t to refcount_t Date: Fri, 17 Mar 2017 13:12:56 +0200 [thread overview] Message-ID: <1489749179-12063-16-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1489749179-12063-1-git-send-email-elena.reshetova@intel.com> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> --- include/net/ipx.h | 7 ++++--- net/ipx/af_ipx.c | 6 +++--- net/ipx/ipx_proc.c | 2 +- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/include/net/ipx.h b/include/net/ipx.h index e5cff68..2de1281 100644 --- a/include/net/ipx.h +++ b/include/net/ipx.h @@ -14,6 +14,7 @@ #include <linux/ipx.h> #include <linux/list.h> #include <linux/slab.h> +#include <linux/refcount.h> struct ipx_address { __be32 net; @@ -54,7 +55,7 @@ struct ipx_interface { /* IPX address */ __be32 if_netnum; unsigned char if_node[IPX_NODE_LEN]; - atomic_t refcnt; + refcount_t refcnt; /* physical device info */ struct net_device *if_dev; @@ -139,7 +140,7 @@ const char *ipx_device_name(struct ipx_interface *intrfc); static __inline__ void ipxitf_hold(struct ipx_interface *intrfc) { - atomic_inc(&intrfc->refcnt); + refcount_inc(&intrfc->refcnt); } void ipxitf_down(struct ipx_interface *intrfc); @@ -157,7 +158,7 @@ int ipxrtr_ioctl(unsigned int cmd, void __user *arg); static __inline__ void ipxitf_put(struct ipx_interface *intrfc) { - if (atomic_dec_and_test(&intrfc->refcnt)) + if (refcount_dec_and_test(&intrfc->refcnt)) ipxitf_down(intrfc); } diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c index 8a9219f..0675b4a 100644 --- a/net/ipx/af_ipx.c +++ b/net/ipx/af_ipx.c @@ -308,7 +308,7 @@ void ipxitf_down(struct ipx_interface *intrfc) static void __ipxitf_put(struct ipx_interface *intrfc) { - if (atomic_dec_and_test(&intrfc->refcnt)) + if (refcount_dec_and_test(&intrfc->refcnt)) __ipxitf_down(intrfc); } @@ -876,7 +876,7 @@ static struct ipx_interface *ipxitf_alloc(struct net_device *dev, __be32 netnum, intrfc->if_ipx_offset = ipx_offset; intrfc->if_sknum = IPX_MIN_EPHEMERAL_SOCKET; INIT_HLIST_HEAD(&intrfc->if_sklist); - atomic_set(&intrfc->refcnt, 1); + refcount_set(&intrfc->refcnt, 1); spin_lock_init(&intrfc->if_sklist_lock); } @@ -1105,7 +1105,7 @@ static struct ipx_interface *ipxitf_auto_create(struct net_device *dev, memcpy((char *)&(intrfc->if_node[IPX_NODE_LEN-dev->addr_len]), dev->dev_addr, dev->addr_len); spin_lock_init(&intrfc->if_sklist_lock); - atomic_set(&intrfc->refcnt, 1); + refcount_set(&intrfc->refcnt, 1); ipxitf_insert(intrfc); dev_hold(dev); } diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c index c1d247e..7d75e4c 100644 --- a/net/ipx/ipx_proc.c +++ b/net/ipx/ipx_proc.c @@ -53,7 +53,7 @@ static int ipx_seq_interface_show(struct seq_file *seq, void *v) seq_printf(seq, "%-11s", ipx_device_name(i)); seq_printf(seq, "%-9s", ipx_frame_name(i->if_dlink_type)); #ifdef IPX_REFCNT_DEBUG - seq_printf(seq, "%6d", atomic_read(&i->refcnt)); + seq_printf(seq, "%6d", refcount_read(&i->refcnt)); #endif seq_puts(seq, "\n"); out: -- 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: Elena Reshetova <elena.reshetova@intel.com> To: netdev@vger.kernel.org Cc: peterz@infradead.org, jchapman@katalix.com, Elena Reshetova <elena.reshetova@intel.com>, johan.hedberg@gmail.com, linux-x25@vger.kernel.org, bridge@lists.linux-foundation.org, jmorris@namei.org, 3chas3@gmail.com, Hans Liljestrand <ishkamiel@gmail.com>, keescook@chromium.org, marcel@holtmann.org, jhs@mojatatu.com, kuznet@ms2.inr.ac.ru, linux-hams@vger.kernel.org, David Windsor <dwindsor@gmail.com>, yoshfuji@linux-ipv6.org, linux-decnet-user@lists.sourceforge.net, linux-kernel@vger.kernel.org, ralf@linux-mips.org, kaber@trash.net, linux-bluetooth@vger.kernel.org, davem@davemloft.net Subject: [Bridge] [PATCH 15/18] net, ipx: convert ipx_interface.refcnt from atomic_t to refcount_t Date: Fri, 17 Mar 2017 13:12:56 +0200 [thread overview] Message-ID: <1489749179-12063-16-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1489749179-12063-1-git-send-email-elena.reshetova@intel.com> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> --- include/net/ipx.h | 7 ++++--- net/ipx/af_ipx.c | 6 +++--- net/ipx/ipx_proc.c | 2 +- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/include/net/ipx.h b/include/net/ipx.h index e5cff68..2de1281 100644 --- a/include/net/ipx.h +++ b/include/net/ipx.h @@ -14,6 +14,7 @@ #include <linux/ipx.h> #include <linux/list.h> #include <linux/slab.h> +#include <linux/refcount.h> struct ipx_address { __be32 net; @@ -54,7 +55,7 @@ struct ipx_interface { /* IPX address */ __be32 if_netnum; unsigned char if_node[IPX_NODE_LEN]; - atomic_t refcnt; + refcount_t refcnt; /* physical device info */ struct net_device *if_dev; @@ -139,7 +140,7 @@ const char *ipx_device_name(struct ipx_interface *intrfc); static __inline__ void ipxitf_hold(struct ipx_interface *intrfc) { - atomic_inc(&intrfc->refcnt); + refcount_inc(&intrfc->refcnt); } void ipxitf_down(struct ipx_interface *intrfc); @@ -157,7 +158,7 @@ int ipxrtr_ioctl(unsigned int cmd, void __user *arg); static __inline__ void ipxitf_put(struct ipx_interface *intrfc) { - if (atomic_dec_and_test(&intrfc->refcnt)) + if (refcount_dec_and_test(&intrfc->refcnt)) ipxitf_down(intrfc); } diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c index 8a9219f..0675b4a 100644 --- a/net/ipx/af_ipx.c +++ b/net/ipx/af_ipx.c @@ -308,7 +308,7 @@ void ipxitf_down(struct ipx_interface *intrfc) static void __ipxitf_put(struct ipx_interface *intrfc) { - if (atomic_dec_and_test(&intrfc->refcnt)) + if (refcount_dec_and_test(&intrfc->refcnt)) __ipxitf_down(intrfc); } @@ -876,7 +876,7 @@ static struct ipx_interface *ipxitf_alloc(struct net_device *dev, __be32 netnum, intrfc->if_ipx_offset = ipx_offset; intrfc->if_sknum = IPX_MIN_EPHEMERAL_SOCKET; INIT_HLIST_HEAD(&intrfc->if_sklist); - atomic_set(&intrfc->refcnt, 1); + refcount_set(&intrfc->refcnt, 1); spin_lock_init(&intrfc->if_sklist_lock); } @@ -1105,7 +1105,7 @@ static struct ipx_interface *ipxitf_auto_create(struct net_device *dev, memcpy((char *)&(intrfc->if_node[IPX_NODE_LEN-dev->addr_len]), dev->dev_addr, dev->addr_len); spin_lock_init(&intrfc->if_sklist_lock); - atomic_set(&intrfc->refcnt, 1); + refcount_set(&intrfc->refcnt, 1); ipxitf_insert(intrfc); dev_hold(dev); } diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c index c1d247e..7d75e4c 100644 --- a/net/ipx/ipx_proc.c +++ b/net/ipx/ipx_proc.c @@ -53,7 +53,7 @@ static int ipx_seq_interface_show(struct seq_file *seq, void *v) seq_printf(seq, "%-11s", ipx_device_name(i)); seq_printf(seq, "%-9s", ipx_frame_name(i->if_dlink_type)); #ifdef IPX_REFCNT_DEBUG - seq_printf(seq, "%6d", atomic_read(&i->refcnt)); + seq_printf(seq, "%6d", refcount_read(&i->refcnt)); #endif seq_puts(seq, "\n"); out: -- 2.7.4
next prev parent reply other threads:[~2017-03-17 11:16 UTC|newest] Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-03-17 11:12 [PATCH 00/18] net subsystem various refcounter conversions Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova 2017-03-17 11:12 ` [PATCH 01/18] net, llc: convert llc_sap.refcnt from atomic_t to refcount_t Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 02/18] net, l2tp: convert l2tp_tunnel.ref_count " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova 2017-03-17 11:12 ` [PATCH 03/18] net, l2tp: convert l2tp_session.ref_count " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 04/18] net, vxlan: convert vxlan_sock.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova 2017-03-17 11:12 ` [PATCH 05/18] net, bluetooth: convert rfcomm_dlc.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-27 14:05 ` Marcel Holtmann 2017-03-27 14:05 ` [Bridge] " Marcel Holtmann 2017-03-17 11:12 ` [PATCH 06/18] net, decnet: convert dn_fib_info.fib_clntref " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 07/18] net, atm: convert atm_dev.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 08/18] net, atm: convert lec_arp_table.usage " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 09/18] net, atm: convert in_cache_entry.use " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 10/18] net, atm: convert eg_cache_entry.use " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 11/18] net, bridge: convert net_bridge_vlan.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 12/18] net, calipso: convert calipso_doi.refcount " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 13/18] net, sched: convert Qdisc.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 14/18] net, lapb: convert lapb_cb.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova [this message] 2017-03-17 11:12 ` [Bridge] [PATCH 15/18] net, ipx: convert ipx_interface.refcnt " Elena Reshetova 2017-03-17 11:12 ` [PATCH 16/18] net, ipx: convert ipx_route.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 17/18] net, netrom: convert nr_neigh.refcount " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 18/18] net, netrom: convert nr_node.refcount " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1489749179-12063-16-git-send-email-elena.reshetova@intel.com \ --to=elena.reshetova@intel.com \ --cc=3chas3@gmail.com \ --cc=bridge@lists.linux-foundation.org \ --cc=davem@davemloft.net \ --cc=dwindsor@gmail.com \ --cc=ishkamiel@gmail.com \ --cc=jchapman@katalix.com \ --cc=jhs@mojatatu.com \ --cc=jmorris@namei.org \ --cc=johan.hedberg@gmail.com \ --cc=kaber@trash.net \ --cc=keescook@chromium.org \ --cc=kuznet@ms2.inr.ac.ru \ --cc=linux-bluetooth@vger.kernel.org \ --cc=linux-decnet-user@lists.sourceforge.net \ --cc=linux-hams@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-x25@vger.kernel.org \ --cc=marcel@holtmann.org \ --cc=netdev@vger.kernel.org \ --cc=peterz@infradead.org \ --cc=ralf@linux-mips.org \ --cc=stephen@networkplumber.org \ --cc=yoshfuji@linux-ipv6.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.