From 850a6212c6fa151076dca045821c75025723bc46 Mon Sep 17 00:00:00 2001 From: "Reshetova, Elena" Date: Tue, 4 Jul 2017 15:53:22 +0300 Subject: net, xfrm: convert xfrm_policy.refcnt from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: David S. Miller --- include/net/xfrm.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include/net') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index f5272a275e8f..e1bd1de2d66a 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -560,7 +560,7 @@ struct xfrm_policy { /* This lock only affects elements except for entry. */ rwlock_t lock; - atomic_t refcnt; + refcount_t refcnt; struct timer_list timer; struct flow_cache_object flo; @@ -816,14 +816,14 @@ static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, static inline void xfrm_pol_hold(struct xfrm_policy *policy) { if (likely(policy != NULL)) - atomic_inc(&policy->refcnt); + refcount_inc(&policy->refcnt); } void xfrm_policy_destroy(struct xfrm_policy *policy); static inline void xfrm_pol_put(struct xfrm_policy *policy) { - if (atomic_dec_and_test(&policy->refcnt)) + if (refcount_dec_and_test(&policy->refcnt)) xfrm_policy_destroy(policy); } -- cgit v1.2.3