diff options
| author | Eric Dumazet <edumazet@google.com> | 2017-08-31 16:48:22 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-09-01 20:22:03 -0700 |
| commit | c1d1b437816f0afa99202be3cb650c9d174667bc (patch) | |
| tree | 14ee9ec0f2e759bb237b2a010aa56989874cc054 /include/linux/skbuff.h | |
| parent | db5bce32fbe19f0c7482fb5a40a33178bbe7b11b (diff) | |
| download | lwn-c1d1b437816f0afa99202be3cb650c9d174667bc.tar.gz lwn-c1d1b437816f0afa99202be3cb650c9d174667bc.zip | |
net: convert (struct ubuf_info)->refcnt to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
v2: added the change in drivers/vhost/net.c as spotted
by Willem.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/skbuff.h')
| -rw-r--r-- | include/linux/skbuff.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index f93cc01064cb..f751f3b93039 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -22,6 +22,7 @@ #include <linux/cache.h> #include <linux/rbtree.h> #include <linux/socket.h> +#include <linux/refcount.h> #include <linux/atomic.h> #include <asm/types.h> @@ -456,7 +457,7 @@ struct ubuf_info { u32 bytelen; }; }; - atomic_t refcnt; + refcount_t refcnt; struct mmpin { struct user_struct *user; @@ -472,7 +473,7 @@ struct ubuf_info *sock_zerocopy_realloc(struct sock *sk, size_t size, static inline void sock_zerocopy_get(struct ubuf_info *uarg) { - atomic_inc(&uarg->refcnt); + refcount_inc(&uarg->refcnt); } void sock_zerocopy_put(struct ubuf_info *uarg); |