Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drivers, firewire: convert fw_node.ref_count from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Elena Reshetova and committed by
Greg Kroah-Hartman
392910cf f7d88d24

+5 -5
+1 -1
drivers/firewire/core-topology.c
··· 124 124 node->initiated_reset = SELF_ID_PHY_INITIATOR(sid); 125 125 node->port_count = port_count; 126 126 127 - atomic_set(&node->ref_count, 1); 127 + refcount_set(&node->ref_count, 1); 128 128 INIT_LIST_HEAD(&node->link); 129 129 130 130 return node;
+4 -4
drivers/firewire/core.h
··· 12 12 #include <linux/slab.h> 13 13 #include <linux/types.h> 14 14 15 - #include <linux/atomic.h> 15 + #include <linux/refcount.h> 16 16 17 17 struct device; 18 18 struct fw_card; ··· 184 184 * local node to this node. */ 185 185 u8 max_depth:4; /* Maximum depth to any leaf node */ 186 186 u8 max_hops:4; /* Max hops in this sub tree */ 187 - atomic_t ref_count; 187 + refcount_t ref_count; 188 188 189 189 /* For serializing node topology into a list. */ 190 190 struct list_head link; ··· 197 197 198 198 static inline struct fw_node *fw_node_get(struct fw_node *node) 199 199 { 200 - atomic_inc(&node->ref_count); 200 + refcount_inc(&node->ref_count); 201 201 202 202 return node; 203 203 } 204 204 205 205 static inline void fw_node_put(struct fw_node *node) 206 206 { 207 - if (atomic_dec_and_test(&node->ref_count)) 207 + if (refcount_dec_and_test(&node->ref_count)) 208 208 kfree(node); 209 209 } 210 210