Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e65f7ee3 authored by Elena Reshetova's avatar Elena Reshetova Committed by David S. Miller
Browse files

drivers, connector: convert cn_callback_entry.refcnt from atomic_t to refcount_t 



atomic_t variables are currently used to implement reference
counters with the following properties:
 - counter is initialized to 1 using atomic_set()
 - a resource is freed upon counter reaching zero
 - once counter reaches zero, its further
   increments aren't allowed
 - counter schema uses basic atomic operations
   (set, inc, inc_not_zero, dec_and_test, etc.)

Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.

The variable cn_callback_entry.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.

Suggested-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarDavid Windsor <dwindsor@gmail.com>
Reviewed-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 709c89b4

drivers/connector/cn_queue.c

+2 −2
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const char *name, 
		return NULL;

	}



	atomic_set(&cbq->refcnt, 1);

	refcount_set(&cbq->refcnt, 1);



	atomic_inc(&dev->refcnt);

	cbq->pdev = dev;
@@ -58,7 +58,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const char *name, 


void cn_queue_release_callback(struct cn_callback_entry *cbq)

{

	if (!atomic_dec_and_test(&cbq->refcnt))

	if (!refcount_dec_and_test(&cbq->refcnt))

		return;



	atomic_dec(&cbq->pdev->refcnt);

drivers/connector/connector.c

+1 −1
Original line number Diff line number Diff line
@@ -157,7 +157,7 @@ static int cn_call_callback(struct sk_buff *skb) 
	spin_lock_bh(&dev->cbdev->queue_lock);

	list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) {

		if (cn_cb_equal(&i->id.id, &msg->id)) {

			atomic_inc(&i->refcnt);

			refcount_inc(&i->refcnt);

			cbq = i;

			break;

		}

include/linux/connector.h

+2 −2
Original line number Diff line number Diff line
@@ -22,7 +22,7 @@ 
#define __CONNECTOR_H





#include <linux/atomic.h>

#include <linux/refcount.h>



#include <linux/list.h>

#include <linux/workqueue.h>
@@ -49,7 +49,7 @@ struct cn_callback_id { 


struct cn_callback_entry {

	struct list_head callback_entry;

	atomic_t refcnt;

	refcount_t refcnt;

	struct cn_queue_dev *pdev;



	struct cn_callback_id id;