From: Elena Reshetova <elena.reshetova@intel.com> To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, davem@davemloft.net, jmorris@namei.org, kaber@trash.net, yoshfuji@linux-ipv6.org, kuznet@ms2.inr.ac.ru, 3chas3@gmail.com, ralf@linux-mips.org, stephen@networkplumber.org, jchapman@katalix.com, jhs@mojatatu.com, bridge@lists.linux-foundation.org, linux-hams@vger.kernel.org, linux-x25@vger.kernel.org, linux-bluetooth@vger.kernel.org, marcel@holtmann.org, johan.hedberg@gmail.com, peterz@infradead.org, keescook@chromium.org, Elena Reshetova <elena.reshetova@intel.com>, Hans Liljestrand <ishkamiel@gmail.com>, David Windsor <dwindsor@gmail.com> Subject: [PATCH 17/18] net, netrom: convert nr_neigh.refcount from atomic_t to refcount_t Date: Fri, 17 Mar 2017 13:12:58 +0200 [thread overview] Message-ID: <1489749179-12063-18-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1489749179-12063-1-git-send-email-elena.reshetova@intel.com> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> --- include/net/netrom.h | 7 ++++--- net/netrom/nr_route.c | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/include/net/netrom.h b/include/net/netrom.h index 110350a..cecb4fd 100644 --- a/include/net/netrom.h +++ b/include/net/netrom.h @@ -11,6 +11,7 @@ #include <linux/list.h> #include <linux/slab.h> #include <net/sock.h> +#include <linux/refcount.h> #define NR_NETWORK_LEN 15 #define NR_TRANSPORT_LEN 5 @@ -93,7 +94,7 @@ struct nr_neigh { unsigned short count; unsigned int number; unsigned char failed; - atomic_t refcount; + refcount_t refcount; }; struct nr_route { @@ -128,11 +129,11 @@ static __inline__ void nr_node_put(struct nr_node *nr_node) } #define nr_neigh_hold(__nr_neigh) \ - atomic_inc(&((__nr_neigh)->refcount)) + refcount_inc(&((__nr_neigh)->refcount)) static __inline__ void nr_neigh_put(struct nr_neigh *nr_neigh) { - if (atomic_dec_and_test(&nr_neigh->refcount)) { + if (refcount_dec_and_test(&nr_neigh->refcount)) { if (nr_neigh->ax25) ax25_cb_put(nr_neigh->ax25); kfree(nr_neigh->digipeat); diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c index d72a4f1..6b72970 100644 --- a/net/netrom/nr_route.c +++ b/net/netrom/nr_route.c @@ -149,7 +149,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic, nr_neigh->count = 0; nr_neigh->number = nr_neigh_no++; nr_neigh->failed = 0; - atomic_set(&nr_neigh->refcount, 1); + refcount_set(&nr_neigh->refcount, 1); if (ax25_digi != NULL && ax25_digi->ndigi > 0) { nr_neigh->digipeat = kmemdup(ax25_digi, @@ -431,7 +431,7 @@ static int __must_check nr_add_neigh(ax25_address *callsign, nr_neigh->count = 0; nr_neigh->number = nr_neigh_no++; nr_neigh->failed = 0; - atomic_set(&nr_neigh->refcount, 1); + refcount_set(&nr_neigh->refcount, 1); if (ax25_digi != NULL && ax25_digi->ndigi > 0) { nr_neigh->digipeat = kmemdup(ax25_digi, sizeof(*ax25_digi), -- 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: Elena Reshetova <elena.reshetova@intel.com> To: netdev@vger.kernel.org Cc: peterz@infradead.org, jchapman@katalix.com, Elena Reshetova <elena.reshetova@intel.com>, johan.hedberg@gmail.com, linux-x25@vger.kernel.org, bridge@lists.linux-foundation.org, jmorris@namei.org, 3chas3@gmail.com, Hans Liljestrand <ishkamiel@gmail.com>, keescook@chromium.org, marcel@holtmann.org, jhs@mojatatu.com, kuznet@ms2.inr.ac.ru, linux-hams@vger.kernel.org, David Windsor <dwindsor@gmail.com>, yoshfuji@linux-ipv6.org, linux-decnet-user@lists.sourceforge.net, linux-kernel@vger.kernel.org, ralf@linux-mips.org, kaber@trash.net, linux-bluetooth@vger.kernel.org, davem@davemloft.net Subject: [Bridge] [PATCH 17/18] net, netrom: convert nr_neigh.refcount from atomic_t to refcount_t Date: Fri, 17 Mar 2017 13:12:58 +0200 [thread overview] Message-ID: <1489749179-12063-18-git-send-email-elena.reshetova@intel.com> (raw) In-Reply-To: <1489749179-12063-1-git-send-email-elena.reshetova@intel.com> refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> --- include/net/netrom.h | 7 ++++--- net/netrom/nr_route.c | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/include/net/netrom.h b/include/net/netrom.h index 110350a..cecb4fd 100644 --- a/include/net/netrom.h +++ b/include/net/netrom.h @@ -11,6 +11,7 @@ #include <linux/list.h> #include <linux/slab.h> #include <net/sock.h> +#include <linux/refcount.h> #define NR_NETWORK_LEN 15 #define NR_TRANSPORT_LEN 5 @@ -93,7 +94,7 @@ struct nr_neigh { unsigned short count; unsigned int number; unsigned char failed; - atomic_t refcount; + refcount_t refcount; }; struct nr_route { @@ -128,11 +129,11 @@ static __inline__ void nr_node_put(struct nr_node *nr_node) } #define nr_neigh_hold(__nr_neigh) \ - atomic_inc(&((__nr_neigh)->refcount)) + refcount_inc(&((__nr_neigh)->refcount)) static __inline__ void nr_neigh_put(struct nr_neigh *nr_neigh) { - if (atomic_dec_and_test(&nr_neigh->refcount)) { + if (refcount_dec_and_test(&nr_neigh->refcount)) { if (nr_neigh->ax25) ax25_cb_put(nr_neigh->ax25); kfree(nr_neigh->digipeat); diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c index d72a4f1..6b72970 100644 --- a/net/netrom/nr_route.c +++ b/net/netrom/nr_route.c @@ -149,7 +149,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic, nr_neigh->count = 0; nr_neigh->number = nr_neigh_no++; nr_neigh->failed = 0; - atomic_set(&nr_neigh->refcount, 1); + refcount_set(&nr_neigh->refcount, 1); if (ax25_digi != NULL && ax25_digi->ndigi > 0) { nr_neigh->digipeat = kmemdup(ax25_digi, @@ -431,7 +431,7 @@ static int __must_check nr_add_neigh(ax25_address *callsign, nr_neigh->count = 0; nr_neigh->number = nr_neigh_no++; nr_neigh->failed = 0; - atomic_set(&nr_neigh->refcount, 1); + refcount_set(&nr_neigh->refcount, 1); if (ax25_digi != NULL && ax25_digi->ndigi > 0) { nr_neigh->digipeat = kmemdup(ax25_digi, sizeof(*ax25_digi), -- 2.7.4
next prev parent reply other threads:[~2017-03-17 11:16 UTC|newest] Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-03-17 11:12 [PATCH 00/18] net subsystem various refcounter conversions Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova 2017-03-17 11:12 ` [PATCH 01/18] net, llc: convert llc_sap.refcnt from atomic_t to refcount_t Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 02/18] net, l2tp: convert l2tp_tunnel.ref_count " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova 2017-03-17 11:12 ` [PATCH 03/18] net, l2tp: convert l2tp_session.ref_count " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 04/18] net, vxlan: convert vxlan_sock.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova 2017-03-17 11:12 ` [PATCH 05/18] net, bluetooth: convert rfcomm_dlc.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-27 14:05 ` Marcel Holtmann 2017-03-27 14:05 ` [Bridge] " Marcel Holtmann 2017-03-17 11:12 ` [PATCH 06/18] net, decnet: convert dn_fib_info.fib_clntref " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 07/18] net, atm: convert atm_dev.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 08/18] net, atm: convert lec_arp_table.usage " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 09/18] net, atm: convert in_cache_entry.use " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 10/18] net, atm: convert eg_cache_entry.use " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 11/18] net, bridge: convert net_bridge_vlan.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 12/18] net, calipso: convert calipso_doi.refcount " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 13/18] net, sched: convert Qdisc.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 14/18] net, lapb: convert lapb_cb.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 15/18] net, ipx: convert ipx_interface.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` [PATCH 16/18] net, ipx: convert ipx_route.refcnt " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova 2017-03-17 11:12 ` Elena Reshetova [this message] 2017-03-17 11:12 ` [Bridge] [PATCH 17/18] net, netrom: convert nr_neigh.refcount " Elena Reshetova 2017-03-17 11:12 ` [PATCH 18/18] net, netrom: convert nr_node.refcount " Elena Reshetova 2017-03-17 11:12 ` [Bridge] " Elena Reshetova
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1489749179-12063-18-git-send-email-elena.reshetova@intel.com \ --to=elena.reshetova@intel.com \ --cc=3chas3@gmail.com \ --cc=bridge@lists.linux-foundation.org \ --cc=davem@davemloft.net \ --cc=dwindsor@gmail.com \ --cc=ishkamiel@gmail.com \ --cc=jchapman@katalix.com \ --cc=jhs@mojatatu.com \ --cc=jmorris@namei.org \ --cc=johan.hedberg@gmail.com \ --cc=kaber@trash.net \ --cc=keescook@chromium.org \ --cc=kuznet@ms2.inr.ac.ru \ --cc=linux-bluetooth@vger.kernel.org \ --cc=linux-decnet-user@lists.sourceforge.net \ --cc=linux-hams@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-x25@vger.kernel.org \ --cc=marcel@holtmann.org \ --cc=netdev@vger.kernel.org \ --cc=peterz@infradead.org \ --cc=ralf@linux-mips.org \ --cc=stephen@networkplumber.org \ --cc=yoshfuji@linux-ipv6.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.