net, atm: convert lec_arp_table.usage from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
458bc30cec
commit
788936641a
|
@ -101,12 +101,12 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc);
|
|||
/* must be done under lec_arp_lock */
|
||||
static inline void lec_arp_hold(struct lec_arp_table *entry)
|
||||
{
|
||||
atomic_inc(&entry->usage);
|
||||
refcount_inc(&entry->usage);
|
||||
}
|
||||
|
||||
static inline void lec_arp_put(struct lec_arp_table *entry)
|
||||
{
|
||||
if (atomic_dec_and_test(&entry->usage))
|
||||
if (refcount_dec_and_test(&entry->usage))
|
||||
kfree(entry);
|
||||
}
|
||||
|
||||
|
@ -1564,7 +1564,7 @@ static struct lec_arp_table *make_entry(struct lec_priv *priv,
|
|||
to_return->last_used = jiffies;
|
||||
to_return->priv = priv;
|
||||
skb_queue_head_init(&to_return->tx_wait);
|
||||
atomic_set(&to_return->usage, 1);
|
||||
refcount_set(&to_return->usage, 1);
|
||||
return to_return;
|
||||
}
|
||||
|
||||
|
|
|
@ -47,7 +47,7 @@ struct lec_arp_table {
|
|||
* the length of the tlvs array
|
||||
*/
|
||||
struct sk_buff_head tx_wait; /* wait queue for outgoing packets */
|
||||
atomic_t usage; /* usage count */
|
||||
refcount_t usage; /* usage count */
|
||||
};
|
||||
|
||||
/*
|
||||
|
|
Loading…
Reference in New Issue
Block a user