Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1680959

[PATCH 04/36] net, vxlan: convert vxlan_sock.refcnt from atomic_t to refcount_t

Show all headers | View raw

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
---
 drivers/net/vxlan.c | 10 +++++-----
 include/net/vxlan.h |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index b04e103..96aa7e6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1034,11 +1034,11 @@ static bool vxlan_group_used(struct vxlan_net *vn, struct vxlan_dev *dev)
 	/* The vxlan_sock is only used by dev, leaving group has
 	 * no effect on other vxlan devices.
 	 */
-	if (family == AF_INET && sock4 && atomic_read(&sock4->refcnt) == 1)
+	if (family == AF_INET && sock4 && refcount_read(&sock4->refcnt) == 1)
 		return false;
 #if IS_ENABLED(CONFIG_IPV6)
 	sock6 = rtnl_dereference(dev->vn6_sock);
-	if (family == AF_INET6 && sock6 && atomic_read(&sock6->refcnt) == 1)
+	if (family == AF_INET6 && sock6 && refcount_read(&sock6->refcnt) == 1)
 		return false;
 #endif
 
@@ -1075,7 +1075,7 @@ static bool __vxlan_sock_release_prep(struct vxlan_sock *vs)
 
 	if (!vs)
 		return false;
-	if (!atomic_dec_and_test(&vs->refcnt))
+	if (!refcount_dec_and_test(&vs->refcnt))
 		return false;
 
 	vn = net_generic(sock_net(vs->sock->sk), vxlan_net_id);
@@ -2825,7 +2825,7 @@ static struct vxlan_sock *vxlan_socket_create(struct net *net, bool ipv6,
 	}
 
 	vs->sock = sock;
-	atomic_set(&vs->refcnt, 1);
+	refcount_set(&vs->refcnt, 1);
 	vs->flags = (flags & VXLAN_F_RCV_FLAGS);
 
 	spin_lock(&vn->sock_lock);
@@ -2860,7 +2860,7 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
 		spin_lock(&vn->sock_lock);
 		vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
 				     vxlan->cfg.dst_port, vxlan->cfg.flags);
-		if (vs && !atomic_add_unless(&vs->refcnt, 1, 0)) {
+		if (vs && !refcount_inc_not_zero(&vs->refcnt)) {
 			spin_unlock(&vn->sock_lock);
 			return -EBUSY;
 		}
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 326e849..3f430e3 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -183,7 +183,7 @@ struct vxlan_sock {
 	struct hlist_node hlist;
 	struct socket	 *sock;
 	struct hlist_head vni_list[VNI_HASH_SIZE];
-	atomic_t	  refcnt;
+	refcount_t	  refcnt;
 	u32		  flags;
 };
 
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/36] v2 net subsystem misc refcounter conversions Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:00 +0200
  [PATCH 29/36] net, sctp: convert sctp_auth_bytes.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:00 +0200
  [PATCH 26/36] net, xfrm: convert xfrm_state.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 04/36] net, vxlan: convert vxlan_sock.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 16/36] net, netrom: convert nr_neigh.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 11/36] net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 12/36] net, sched: convert Qdisc.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 05/36] net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 01/36] net, llc: convert llc_sap.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 32/36] net, sctp: convert sctp_transport.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 22/36] net, rds: convert rds_mr.r_refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 35/36] net, ax25: convert ax25_route.refcount from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 07/36] net, atm: convert lec_arp_table.usage from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 14/36] net, ipx: convert ipx_interface.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  [PATCH 31/36] net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-07-04 15:10 +0200
  Re: [PATCH 00/36] v2 net subsystem misc refcounter conversions David Miller <davem@davemloft.net> - 2017-07-05 00:10 +0200
    RE: [PATCH 00/36] v2 net subsystem misc refcounter conversions "Reshetova, Elena" <elena.reshetova@intel.com> - 2017-07-05 11:10 +0200

csiph-web