Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22a33651 authored by Elena Reshetova's avatar Elena Reshetova Committed by Greg Kroah-Hartman
Browse files

drivers: convert sbd_duart.map_guard from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8961df89

drivers/tty/serial/sb1250-duart.c

+7 −11
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ 
#include <linux/tty_flip.h>

#include <linux/types.h>



#include <linux/atomic.h>

#include <linux/refcount.h>

#include <asm/io.h>

#include <asm/war.h>
@@ -103,7 +103,7 @@ struct sbd_port { 
struct sbd_duart {

	struct sbd_port		sport[2];

	unsigned long		mapctrl;

	atomic_t		map_guard;

	refcount_t		map_guard;

};



#define to_sport(uport) container_of(uport, struct sbd_port, port)
@@ -654,15 +654,13 @@ static void sbd_release_port(struct uart_port *uport) 
{

	struct sbd_port *sport = to_sport(uport);

	struct sbd_duart *duart = sport->duart;

	int map_guard;



	iounmap(sport->memctrl);

	sport->memctrl = NULL;

	iounmap(uport->membase);

	uport->membase = NULL;



	map_guard = atomic_add_return(-1, &duart->map_guard);

	if (!map_guard)

	if(refcount_dec_and_test(&duart->map_guard))

		release_mem_region(duart->mapctrl, DUART_CHANREG_SPACING);

	release_mem_region(uport->mapbase, DUART_CHANREG_SPACING);

}
@@ -698,7 +696,6 @@ static int sbd_request_port(struct uart_port *uport) 
{

	const char *err = KERN_ERR "sbd: Unable to reserve MMIO resource\n";

	struct sbd_duart *duart = to_sport(uport)->duart;

	int map_guard;

	int ret = 0;



	if (!request_mem_region(uport->mapbase, DUART_CHANREG_SPACING,
@@ -706,11 +703,11 @@ static int sbd_request_port(struct uart_port *uport) 
		printk(err);

		return -EBUSY;

	}

	map_guard = atomic_add_return(1, &duart->map_guard);

	if (map_guard == 1) {

	refcount_inc(&duart->map_guard);

	if (refcount_read(&duart->map_guard) == 1) {

		if (!request_mem_region(duart->mapctrl, DUART_CHANREG_SPACING,

					"sb1250-duart")) {

			atomic_add(-1, &duart->map_guard);

			refcount_dec(&duart->map_guard);

			printk(err);

			ret = -EBUSY;

		}
@@ -718,8 +715,7 @@ static int sbd_request_port(struct uart_port *uport) 
	if (!ret) {

		ret = sbd_map_port(uport);

		if (ret) {

			map_guard = atomic_add_return(-1, &duart->map_guard);

			if (!map_guard)

			if (refcount_dec_and_test(&duart->map_guard))

				release_mem_region(duart->mapctrl,

						   DUART_CHANREG_SPACING);

		}