Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 392910cf authored by Elena Reshetova's avatar Elena Reshetova Committed by Greg Kroah-Hartman
Browse files

drivers, firewire: convert fw_node.ref_count from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f7d88d24

drivers/firewire/core-topology.c

+1 −1
Original line number Diff line number Diff line
@@ -124,7 +124,7 @@ static struct fw_node *fw_node_create(u32 sid, int port_count, int color) 
	node->initiated_reset = SELF_ID_PHY_INITIATOR(sid);

	node->port_count = port_count;



	atomic_set(&node->ref_count, 1);

	refcount_set(&node->ref_count, 1);

	INIT_LIST_HEAD(&node->link);



	return node;

drivers/firewire/core.h

+4 −4
Original line number Diff line number Diff line
@@ -12,7 +12,7 @@ 
#include <linux/slab.h>

#include <linux/types.h>



#include <linux/atomic.h>

#include <linux/refcount.h>



struct device;

struct fw_card;
@@ -184,7 +184,7 @@ struct fw_node { 
			 * local node to this node. */

	u8 max_depth:4;	/* Maximum depth to any leaf node */

	u8 max_hops:4;	/* Max hops in this sub tree */

	atomic_t ref_count;

	refcount_t ref_count;



	/* For serializing node topology into a list. */

	struct list_head link;
@@ -197,14 +197,14 @@ struct fw_node { 


static inline struct fw_node *fw_node_get(struct fw_node *node)

{

	atomic_inc(&node->ref_count);

	refcount_inc(&node->ref_count);



	return node;

}



static inline void fw_node_put(struct fw_node *node)

{

	if (atomic_dec_and_test(&node->ref_count))

	if (refcount_dec_and_test(&node->ref_count))

		kfree(node);

}