Commit c1d1b437 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: convert (struct ubuf_info)->refcnt to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

v2: added the change in drivers/vhost/net.c as spotted
by Willem.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent db5bce32

drivers/vhost/net.c

+1 −1
Original line number Diff line number Diff line
@@ -533,7 +533,7 @@ static void handle_tx(struct vhost_net *net) 
			ubuf->callback = vhost_zerocopy_callback;

			ubuf->ctx = nvq->ubufs;

			ubuf->desc = nvq->upend_idx;

			atomic_set(&ubuf->refcnt, 1);

			refcount_set(&ubuf->refcnt, 1);

			msg.msg_control = ubuf;

			msg.msg_controllen = sizeof(ubuf);

			ubufs = nvq->ubufs;

include/linux/skbuff.h

+3 −2
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <linux/cache.h>

#include <linux/rbtree.h>

#include <linux/socket.h>

#include <linux/refcount.h>



#include <linux/atomic.h>

#include <asm/types.h>
@@ -456,7 +457,7 @@ struct ubuf_info { 
			u32 bytelen;

		};

	};

	atomic_t refcnt;

	refcount_t refcnt;



	struct mmpin {

		struct user_struct *user;
@@ -472,7 +473,7 @@ struct ubuf_info *sock_zerocopy_realloc(struct sock *sk, size_t size, 


static inline void sock_zerocopy_get(struct ubuf_info *uarg)

{

	atomic_inc(&uarg->refcnt);

	refcount_inc(&uarg->refcnt);

}



void sock_zerocopy_put(struct ubuf_info *uarg);

net/core/skbuff.c

+3 −3
Original line number Diff line number Diff line
@@ -963,7 +963,7 @@ struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size) 
	uarg->len = 1;

	uarg->bytelen = size;

	uarg->zerocopy = 1;

	atomic_set(&uarg->refcnt, 1);

	refcount_set(&uarg->refcnt, 1);

	sock_hold(sk);



	return uarg;
@@ -1086,7 +1086,7 @@ EXPORT_SYMBOL_GPL(sock_zerocopy_callback); 


void sock_zerocopy_put(struct ubuf_info *uarg)

{

	if (uarg && atomic_dec_and_test(&uarg->refcnt)) {

	if (uarg && refcount_dec_and_test(&uarg->refcnt)) {

		if (uarg->callback)

			uarg->callback(uarg, uarg->zerocopy);

		else
@@ -1483,7 +1483,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, 
		if (skb_orphan_frags(skb, gfp_mask))

			goto nofrags;

		if (skb_zcopy(skb))

			atomic_inc(&skb_uarg(skb)->refcnt);

			refcount_inc(&skb_uarg(skb)->refcnt);

		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)

			skb_frag_ref(skb, i);

CRA Git | Maintained and supported by SUSTech CRA and CCSE