net: convert netlbl_lsm_cache.refcount from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Reshetova, Elena 2017-06-30 13:08:09 +03:00 committed by David S. Miller
parent c122e14df2
commit b4217b8289
3 changed files with 8 additions and 8 deletions

View file

@ -37,7 +37,7 @@
#include <linux/in6.h>
#include <net/netlink.h>
#include <net/request_sock.h>
#include <linux/atomic.h>
#include <linux/refcount.h>
struct cipso_v4_doi;
struct calipso_doi;
@ -136,7 +136,7 @@ struct netlbl_audit {
*
*/
struct netlbl_lsm_cache {
atomic_t refcount;
refcount_t refcount;
void (*free) (const void *data);
void *data;
};
@ -295,7 +295,7 @@ static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags)
cache = kzalloc(sizeof(*cache), flags);
if (cache)
atomic_set(&cache->refcount, 1);
refcount_set(&cache->refcount, 1);
return cache;
}
@ -309,7 +309,7 @@ static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags)
*/
static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache)
{
if (!atomic_dec_and_test(&cache->refcount))
if (!refcount_dec_and_test(&cache->refcount))
return;
if (cache->free)