Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22c70d1a authored by Elena Reshetova's avatar Elena Reshetova Committed by Martin K. Petersen
Browse files

scsi: libfc: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t 



refcount_t type and corresponding API should be used instead of atomic_t
when the variable is used as a reference counter. This allows to avoid
accidental refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Acked-by: default avatarJohannes Thumshirn <jth@kernel.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent fb5fe0fd

drivers/scsi/libfc/fc_fcp.c

+3 −3
Original line number Diff line number Diff line
@@ -154,7 +154,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lport, gfp_t gfp) 
		memset(fsp, 0, sizeof(*fsp));

		fsp->lp = lport;

		fsp->xfer_ddp = FC_XID_UNKNOWN;

		atomic_set(&fsp->ref_cnt, 1);

		refcount_set(&fsp->ref_cnt, 1);

		init_timer(&fsp->timer);

		fsp->timer.data = (unsigned long)fsp;

		INIT_LIST_HEAD(&fsp->list);
@@ -175,7 +175,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lport, gfp_t gfp) 
 */

static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)

{

	if (atomic_dec_and_test(&fsp->ref_cnt)) {

	if (refcount_dec_and_test(&fsp->ref_cnt)) {

		struct fc_fcp_internal *si = fc_get_scsi_internal(fsp->lp);



		mempool_free(fsp, si->scsi_pkt_pool);
@@ -188,7 +188,7 @@ static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp) 
 */

static void fc_fcp_pkt_hold(struct fc_fcp_pkt *fsp)

{

	atomic_inc(&fsp->ref_cnt);

	refcount_inc(&fsp->ref_cnt);

}



/**

include/scsi/libfc.h

+2 −1
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
#include <linux/timer.h>

#include <linux/if.h>

#include <linux/percpu.h>

#include <linux/refcount.h>



#include <scsi/scsi_transport.h>

#include <scsi/scsi_transport_fc.h>
@@ -321,7 +322,7 @@ struct fc_seq_els_data { 
 */

struct fc_fcp_pkt {

	spinlock_t	  scsi_pkt_lock;

	atomic_t	  ref_cnt;

	refcount_t	  ref_cnt;



	/* SCSI command and data transfer information */

	u32		  data_len;