summaryrefslogtreecommitdiff
path: root/net/atm/clip.c
diff options
context:
space:
mode:
authorReshetova, Elena <elena.reshetova@intel.com>2017-06-30 13:07:55 +0300
committerDavid S. Miller <davem@davemloft.net>2017-07-01 17:39:07 +0300
commit9f23743017d11c103b38d2fa1f64674baeca41cd (patch)
tree272ef703abacf82daa5059b911f2a52159734294 /net/atm/clip.c
parent1cc9a98b59ba92fece1277f76aa43e05f34936a6 (diff)
downloadlinux-9f23743017d11c103b38d2fa1f64674baeca41cd.tar.xz
net: convert neighbour.refcnt from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/atm/clip.c')
-rw-r--r--net/atm/clip.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/atm/clip.c b/net/atm/clip.c
index a7e4018370b4..47c36f449df0 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -137,11 +137,11 @@ static int neigh_check_cb(struct neighbour *n)
if (entry->vccs || time_before(jiffies, entry->expires))
return 0;
- if (atomic_read(&n->refcnt) > 1) {
+ if (refcount_read(&n->refcnt) > 1) {
struct sk_buff *skb;
pr_debug("destruction postponed with ref %d\n",
- atomic_read(&n->refcnt));
+ refcount_read(&n->refcnt));
while ((skb = skb_dequeue(&n->arp_queue)) != NULL)
dev_kfree_skb(skb);
@@ -767,7 +767,7 @@ static void atmarp_info(struct seq_file *seq, struct neighbour *n,
seq_printf(seq, "(resolving)\n");
else
seq_printf(seq, "(expired, ref %d)\n",
- atomic_read(&entry->neigh->refcnt));
+ refcount_read(&entry->neigh->refcnt));
} else if (!svc) {
seq_printf(seq, "%d.%d.%d\n",
clip_vcc->vcc->dev->number,