A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

net, xfrm: convert xfrm_state.refcnt from atomic_t to refcount_t

Browse source 
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <[email protected]>
Signed-off-by: Hans Liljestrand <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
Signed-off-by: David Windsor <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Reshetova, Elena 2017-07-04 15:53:21 +03:00 • committed by David S. Miller
commit 88755e9c7c
2 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
include/net/xfrm.h
View file

@ -13,6 +13,7 @@
#include <linux/mutex.h>
#include <linux/audit.h>
#include <linux/slab.h>
#include <linux/refcount.h>
#include <net/sock.h>
#include <net/dst.h>
@ -137,7 +138,7 @@ struct xfrm_state {
struct hlist_node bysrc;
struct hlist_node byspi;
atomic_t refcnt;
refcount_t refcnt;
spinlock_t lock;
struct xfrm_id id;
@ -837,18 +838,18 @@ void __xfrm_state_destroy(struct xfrm_state *);
static inline void __xfrm_state_put(struct xfrm_state *x)
{
atomic_dec(&x->refcnt);
refcount_dec(&x->refcnt);
}
static inline void xfrm_state_put(struct xfrm_state *x)
{
if (atomic_dec_and_test(&x->refcnt))
if (refcount_dec_and_test(&x->refcnt))
__xfrm_state_destroy(x);
}
static inline void xfrm_state_hold(struct xfrm_state *x)
{
atomic_inc(&x->refcnt);
refcount_inc(&x->refcnt);
}
static inline bool addr_match(const void *token1, const void *token2,