Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 387ad967 authored by Elena Reshetova's avatar Elena Reshetova Committed by Tejun Heo
Browse files

kernel: convert cgroup_namespace.count from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent c1ae3cfa

include/linux/cgroup.h

+4 −3
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <linux/ns_common.h>

#include <linux/nsproxy.h>

#include <linux/user_namespace.h>

#include <linux/refcount.h>



#include <linux/cgroup-defs.h>
@@ -640,7 +641,7 @@ static inline void cgroup_sk_free(struct sock_cgroup_data *skcd) {} 
#endif	/* CONFIG_CGROUP_DATA */



struct cgroup_namespace {

	atomic_t		count;

	refcount_t		count;

	struct ns_common	ns;

	struct user_namespace	*user_ns;

	struct ucounts		*ucounts;
@@ -675,12 +676,12 @@ copy_cgroup_ns(unsigned long flags, struct user_namespace *user_ns, 
static inline void get_cgroup_ns(struct cgroup_namespace *ns)

{

	if (ns)

		atomic_inc(&ns->count);

		refcount_inc(&ns->count);

}



static inline void put_cgroup_ns(struct cgroup_namespace *ns)

{

	if (ns && atomic_dec_and_test(&ns->count))

	if (ns && refcount_dec_and_test(&ns->count))

		free_cgroup_ns(ns);

}

kernel/cgroup/cgroup.c

+1 −1
Original line number Diff line number Diff line
@@ -189,7 +189,7 @@ static u16 have_canfork_callback __read_mostly; 


/* cgroup namespace for init task */

struct cgroup_namespace init_cgroup_ns = {

	.count		= { .counter = 2, },

	.count		= REFCOUNT_INIT(2),

	.user_ns	= &init_user_ns,

	.ns.ops		= &cgroupns_operations,

	.ns.inum	= PROC_CGROUP_INIT_INO,

kernel/cgroup/namespace.c

+1 −1
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ static struct cgroup_namespace *alloc_cgroup_ns(void) 
		kfree(new_ns);

		return ERR_PTR(ret);

	}

	atomic_set(&new_ns->count, 1);

	refcount_set(&new_ns->count, 1);

	new_ns->ns.ops = &cgroupns_operations;

	return new_ns;

}