summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorElena Reshetova <elena.reshetova@intel.com>2017-03-17 14:12:46 +0300
committerMarcel Holtmann <marcel@holtmann.org>2017-04-12 23:02:36 +0300
commitdab6b5daeeb3e70bfb2ed2d6d6f02dd387e3b338 (patch)
treef53267726421189109c1e348965ac84e4281ac5c /include
parent9232259913022c1ab96f7bf2b87598b89b942f1f (diff)
downloadlinux-dab6b5daeeb3e70bfb2ed2d6d6f02dd387e3b338.tar.xz
Bluetooth: convert rfcomm_dlc.refcnt from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'include')
-rw-r--r--include/net/bluetooth/rfcomm.h8
1 files changed, 5 insertions, 3 deletions
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 4190af53a46a..da4acefe39c8 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -21,6 +21,8 @@
SOFTWARE IS DISCLAIMED.
*/
+#include <linux/refcount.h>
+
#ifndef __RFCOMM_H
#define __RFCOMM_H
@@ -174,7 +176,7 @@ struct rfcomm_dlc {
struct mutex lock;
unsigned long state;
unsigned long flags;
- atomic_t refcnt;
+ refcount_t refcnt;
u8 dlci;
u8 addr;
u8 priority;
@@ -247,12 +249,12 @@ struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel);
static inline void rfcomm_dlc_hold(struct rfcomm_dlc *d)
{
- atomic_inc(&d->refcnt);
+ refcount_inc(&d->refcnt);
}
static inline void rfcomm_dlc_put(struct rfcomm_dlc *d)
{
- if (atomic_dec_and_test(&d->refcnt))
+ if (refcount_dec_and_test(&d->refcnt))
rfcomm_dlc_free(d);
}