ipc: Convert ipc_kern_perm.refcount to refcount_t
PATCH v2 1/1 ipc: Convert ipc_kern_perm.refcount to refcount_t
From: Elena Reshetova <[email protected]>
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations.
Cc Manfred Spraul <[email protected]>
Signed-off-by Elena Reshetova <[email protected]>
Signed-off-by Hans Liljestrand <[email protected]>
Signed-off-by David Windsor <[email protected]>
Signed-off-by Kees Cook <[email protected]>
---
Brown paper bag update: forgot to commit a missing hunk...
--- include/linux/ipc.h | 3 ++- ipc/util.c | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-)
include/linux/ipc.h +2 -1
@@ -3,6 +3,7 @@#include <linux/spinlock.h> #include <linux/uidgid.h> +#include <linux/refcount.h> #include <uapi/linux/ipc.h> #define IPCMNI 32768/* <= MAX_INT limit for ipc arrays (including sysctl changes) */
@@ -22,7 +23,7 @@ struct kern_ipc_perm {void *security;struct rcu_head rcu; - atomic_t refcount; + refcount_t refcount; }____cacheline_aligned_in_smp ;#endif /* _LINUX_IPC_H */
ipc/util.c +3 -3
@@ -232,7 +232,7 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)idr_preload (GFP_KERNEL ); -atomic_set (&new->refcount,1 ); +refcount_set (&new->refcount,1 );spin_lock_init (&new->lock); new->deleted = false;rcu_read_lock ();
@@ -397,13 +397,13 @@ void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)int ipc_rcu_getref (struct kern_ipc_perm *ptr) { -return atomic_inc_not_zero (&ptr->refcount); +return refcount_inc_not_zero (&ptr->refcount); }void ipc_rcu_putref (struct kern_ipc_perm *ptr,void (*func)(struct rcu_head *head)) { -if (!atomic_dec_and_test (&ptr->refcount)) +if (!refcount_dec_and_test (&ptr->refcount))return ;call_rcu (&ptr->rcu, func);
Signature · 6 lines
2.7.4 -- Kees Cook Pixel Security