Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b7ddc981 authored by Elena Reshetova's avatar Elena Reshetova Committed by Greg Kroah-Hartman
Browse files

drivers, usb: convert dev_data.count from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 43938613

drivers/usb/gadget/legacy/inode.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -27,6 +27,7 @@ 
#include <linux/mmu_context.h>

#include <linux/mmu_context.h>

#include <linux/aio.h>

#include <linux/aio.h>

#include <linux/uio.h>

#include <linux/uio.h>

#include <linux/refcount.h>





#include <linux/device.h>

#include <linux/device.h>

#include <linux/moduleparam.h>

#include <linux/moduleparam.h>
@@ -114,7 +115,7 @@ enum ep0_state { 




struct dev_data {

struct dev_data {

	spinlock_t			lock;

	spinlock_t			lock;

	atomic_t			count;

	refcount_t			count;

	enum ep0_state			state;		/* P: lock */

	enum ep0_state			state;		/* P: lock */

	struct usb_gadgetfs_event	event [N_EVENT];

	struct usb_gadgetfs_event	event [N_EVENT];

	unsigned			ev_next;

	unsigned			ev_next;
@@ -150,12 +151,12 @@ struct dev_data { 




static inline void get_dev (struct dev_data *data)

static inline void get_dev (struct dev_data *data)

{

{

	atomic_inc (&data->count);

	refcount_inc (&data->count);

}

}





static void put_dev (struct dev_data *data)

static void put_dev (struct dev_data *data)

{

{

	if (likely (!atomic_dec_and_test (&data->count)))

	if (likely (!refcount_dec_and_test (&data->count)))

		return;

		return;

	/* needs no more cleanup */

	/* needs no more cleanup */

	BUG_ON (waitqueue_active (&data->wait));

	BUG_ON (waitqueue_active (&data->wait));
@@ -170,7 +171,7 @@ static struct dev_data *dev_new (void) 
	if (!dev)

	if (!dev)

		return NULL;

		return NULL;

	dev->state = STATE_DEV_DISABLED;

	dev->state = STATE_DEV_DISABLED;

	atomic_set (&dev->count, 1);

	refcount_set (&dev->count, 1);

	spin_lock_init (&dev->lock);

	spin_lock_init (&dev->lock);

	INIT_LIST_HEAD (&dev->epfiles);

	INIT_LIST_HEAD (&dev->epfiles);

	init_waitqueue_head (&dev->wait);

	init_waitqueue_head (&dev->wait);