From 803ea85053b75d35f9ebb3aa7a28db35d82c6d82 Mon Sep 17 00:00:00 2001 From: "Reshetova, Elena" Date: Tue, 4 Jul 2017 15:53:17 +0300 Subject: net, rds: convert rds_mr.r_refcount from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: David S. Miller --- net/rds/rds.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'net/rds/rds.h') diff --git a/net/rds/rds.h b/net/rds/rds.h index 35ceaa2139c3..ea72d6e33c14 100644 --- a/net/rds/rds.h +++ b/net/rds/rds.h @@ -277,7 +277,7 @@ struct rds_incoming { struct rds_mr { struct rb_node r_rb_node; - atomic_t r_refcount; + refcount_t r_refcount; u32 r_key; /* A copy of the creation flags */ @@ -857,7 +857,7 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm, void __rds_put_mr_final(struct rds_mr *mr); static inline void rds_mr_put(struct rds_mr *mr) { - if (atomic_dec_and_test(&mr->r_refcount)) + if (refcount_dec_and_test(&mr->r_refcount)) __rds_put_mr_final(mr); } -- cgit v1.2.3