diff options
| author | Reshetova, Elena <elena.reshetova@intel.com> | 2017-07-04 15:53:07 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-07-04 22:35:16 +0100 |
| commit | 7b9364050246bd4c24b36b71c8990b2922dcc027 (patch) | |
| tree | a63212cfd2110187b7f3a58ac14c486d0c502f4e /net/sched/sch_api.c | |
| parent | edcd9270be1ba9c80cd0789ffbae7a7d204b7b05 (diff) | |
| download | linux-rpi3-7b9364050246bd4c24b36b71c8990b2922dcc027.tar.gz linux-rpi3-7b9364050246bd4c24b36b71c8990b2922dcc027.tar.bz2 linux-rpi3-7b9364050246bd4c24b36b71c8990b2922dcc027.zip | |
net, sched: convert Qdisc.refcnt from atomic_t to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_api.c')
| -rw-r--r-- | net/sched/sch_api.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 43b94c7b69bd..bd24a550e0f9 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -839,7 +839,7 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, old = dev_graft_qdisc(dev_queue, new); if (new && i > 0) - atomic_inc(&new->refcnt); + refcount_inc(&new->refcnt); if (!ingress) qdisc_destroy(old); @@ -850,7 +850,7 @@ skip: notify_and_destroy(net, skb, n, classid, dev->qdisc, new); if (new && !new->ops->attach) - atomic_inc(&new->refcnt); + refcount_inc(&new->refcnt); dev->qdisc = new ? : &noop_qdisc; if (new && new->ops->attach) @@ -1259,7 +1259,7 @@ replay: if (q == p || (p && check_loop(q, p, 0))) return -ELOOP; - atomic_inc(&q->refcnt); + refcount_inc(&q->refcnt); goto graft; } else { if (!q) @@ -1374,7 +1374,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid, tcm->tcm_ifindex = qdisc_dev(q)->ifindex; tcm->tcm_parent = clid; tcm->tcm_handle = q->handle; - tcm->tcm_info = atomic_read(&q->refcnt); + tcm->tcm_info = refcount_read(&q->refcnt); if (nla_put_string(skb, TCA_KIND, q->ops->id)) goto nla_put_failure; if (q->ops->dump && q->ops->dump(q, skb) < 0) |