net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
66af846fe5
commit
e0542dd518
|
@ -2,6 +2,7 @@
|
||||||
#define _NET_DN_FIB_H
|
#define _NET_DN_FIB_H
|
||||||
|
|
||||||
#include <linux/netlink.h>
|
#include <linux/netlink.h>
|
||||||
|
#include <linux/refcount.h>
|
||||||
|
|
||||||
extern const struct nla_policy rtm_dn_policy[];
|
extern const struct nla_policy rtm_dn_policy[];
|
||||||
|
|
||||||
|
@ -28,7 +29,7 @@ struct dn_fib_info {
|
||||||
struct dn_fib_info *fib_next;
|
struct dn_fib_info *fib_next;
|
||||||
struct dn_fib_info *fib_prev;
|
struct dn_fib_info *fib_prev;
|
||||||
int fib_treeref;
|
int fib_treeref;
|
||||||
atomic_t fib_clntref;
|
refcount_t fib_clntref;
|
||||||
int fib_dead;
|
int fib_dead;
|
||||||
unsigned int fib_flags;
|
unsigned int fib_flags;
|
||||||
int fib_protocol;
|
int fib_protocol;
|
||||||
|
@ -130,7 +131,7 @@ void dn_fib_free_info(struct dn_fib_info *fi);
|
||||||
|
|
||||||
static inline void dn_fib_info_put(struct dn_fib_info *fi)
|
static inline void dn_fib_info_put(struct dn_fib_info *fi)
|
||||||
{
|
{
|
||||||
if (atomic_dec_and_test(&fi->fib_clntref))
|
if (refcount_dec_and_test(&fi->fib_clntref))
|
||||||
dn_fib_free_info(fi);
|
dn_fib_free_info(fi);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -389,7 +389,7 @@ link_it:
|
||||||
}
|
}
|
||||||
|
|
||||||
fi->fib_treeref++;
|
fi->fib_treeref++;
|
||||||
atomic_inc(&fi->fib_clntref);
|
refcount_set(&fi->fib_clntref, 1);
|
||||||
spin_lock(&dn_fib_info_lock);
|
spin_lock(&dn_fib_info_lock);
|
||||||
fi->fib_next = dn_fib_info_list;
|
fi->fib_next = dn_fib_info_list;
|
||||||
fi->fib_prev = NULL;
|
fi->fib_prev = NULL;
|
||||||
|
@ -425,7 +425,7 @@ int dn_fib_semantic_match(int type, struct dn_fib_info *fi, const struct flowidn
|
||||||
switch (type) {
|
switch (type) {
|
||||||
case RTN_NAT:
|
case RTN_NAT:
|
||||||
DN_FIB_RES_RESET(*res);
|
DN_FIB_RES_RESET(*res);
|
||||||
atomic_inc(&fi->fib_clntref);
|
refcount_inc(&fi->fib_clntref);
|
||||||
return 0;
|
return 0;
|
||||||
case RTN_UNICAST:
|
case RTN_UNICAST:
|
||||||
case RTN_LOCAL:
|
case RTN_LOCAL:
|
||||||
|
@ -438,7 +438,7 @@ int dn_fib_semantic_match(int type, struct dn_fib_info *fi, const struct flowidn
|
||||||
}
|
}
|
||||||
if (nhsel < fi->fib_nhs) {
|
if (nhsel < fi->fib_nhs) {
|
||||||
res->nh_sel = nhsel;
|
res->nh_sel = nhsel;
|
||||||
atomic_inc(&fi->fib_clntref);
|
refcount_inc(&fi->fib_clntref);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
endfor_nexthops(fi);
|
endfor_nexthops(fi);
|
||||||
|
|
Loading…
Reference in New Issue