net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t (5534a51a) · Commits · 戴 / test

refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by:

Elena Reshetova <elena.reshetova@intel.com> Signed-off-by:

Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by:

Kees Cook <keescook@chromium.org> Signed-off-by:

David Windsor <dwindsor@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

include/net/x25.h

+3 −3

Original line number	Diff line number	Diff line
		@@ -142,7 +142,7 @@ struct x25_neigh {
		unsigned long t20;
		struct timer_list t20timer;
		unsigned long global_facil_mask;
		atomic_t refcnt;
		refcount_t refcnt;
		};

		struct x25_sock {
		@@ -243,12 +243,12 @@ void x25_link_free(void);
		/* x25_neigh.c */
		static __inline__ void x25_neigh_hold(struct x25_neigh *nb)
		{
		atomic_inc(&nb->refcnt);
		refcount_inc(&nb->refcnt);
		}

		static __inline__ void x25_neigh_put(struct x25_neigh *nb)
		{
		if (atomic_dec_and_test(&nb->refcnt))
		if (refcount_dec_and_test(&nb->refcnt))
		kfree(nb);
		}

net/x25/x25_link.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -266,7 +266,7 @@ void x25_link_device_up(struct net_device *dev)
		X25_MASK_PACKET_SIZE \|
		X25_MASK_WINDOW_SIZE;
		nb->t20 = sysctl_x25_restart_request_timeout;
		atomic_set(&nb->refcnt, 1);
		refcount_set(&nb->refcnt, 1);

		write_lock_bh(&x25_neigh_list_lock);
		list_add(&nb->node, &x25_neigh_list);

Admin message