GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-28 09:31:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

scsi: libfc: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t

Browse source 
refcount_t type and corresponding API should be used instead of atomic_t
when the variable is used as a reference counter. This allows to avoid
accidental refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Acked-by: Johannes Thumshirn <jth@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Elena Reshetova 2017-03-09 09:44:02 +02:00 • committed by Martin K. Petersen
parent fb5fe0fd62
commit 22c70d1a9c
2 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/scsi/libfc/fc_fcp.c
View file

@ -154,7 +154,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lport, gfp_t gfp)
memset(fsp, 0, sizeof(*fsp)); memset(fsp, 0, sizeof(*fsp));
fsp->lp = lport; fsp->lp = lport;
fsp->xfer_ddp = FC_XID_UNKNOWN; fsp->xfer_ddp = FC_XID_UNKNOWN;
atomic_set(&fsp->ref_cnt, 1); refcount_set(&fsp->ref_cnt, 1);
init_timer(&fsp->timer); init_timer(&fsp->timer);
fsp->timer.data = (unsigned long)fsp; fsp->timer.data = (unsigned long)fsp;
INIT_LIST_HEAD(&fsp->list); INIT_LIST_HEAD(&fsp->list);
@ -175,7 +175,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lport, gfp_t gfp)
*/ */
static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp) static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
{ {
if (atomic_dec_and_test(&fsp->ref_cnt)) { if (refcount_dec_and_test(&fsp->ref_cnt)) {
struct fc_fcp_internal *si = fc_get_scsi_internal(fsp->lp); struct fc_fcp_internal *si = fc_get_scsi_internal(fsp->lp);
mempool_free(fsp, si->scsi_pkt_pool); mempool_free(fsp, si->scsi_pkt_pool);
@ -188,7 +188,7 @@ static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
*/ */
static void fc_fcp_pkt_hold(struct fc_fcp_pkt *fsp) static void fc_fcp_pkt_hold(struct fc_fcp_pkt *fsp)
{ {
atomic_inc(&fsp->ref_cnt); refcount_inc(&fsp->ref_cnt);
} }
/** /**

3
include/scsi/libfc.h
View file

@ -23,6 +23,7 @@
#include <linux/timer.h> #include <linux/timer.h>
#include <linux/if.h> #include <linux/if.h>
#include <linux/percpu.h> #include <linux/percpu.h>
#include <linux/refcount.h>
#include <scsi/scsi_transport.h> #include <scsi/scsi_transport.h>
#include <scsi/scsi_transport_fc.h> #include <scsi/scsi_transport_fc.h>
@ -321,7 +322,7 @@ struct fc_seq_els_data {
*/ */
struct fc_fcp_pkt { struct fc_fcp_pkt {
spinlock_t scsi_pkt_lock; spinlock_t scsi_pkt_lock;
atomic_t ref_cnt; refcount_t ref_cnt;
/* SCSI command and data transfer information */ /* SCSI command and data transfer information */
u32 data_len; u32 data_len;