Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-04 04:06:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

net: convert netlbl_lsm_cache.refcount from atomic_t to refcount_t

Browse Source 
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Reshetova, Elena 2017-06-30 13:08:09 +03:00 committed by David S. Miller
parent c122e14df2
commit b4217b8289
3 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/net/netlabel.h
View File

@ -37,7 +37,7 @@
#include <linux/in6.h> #include <linux/in6.h>
#include <net/netlink.h> #include <net/netlink.h>
#include <net/request_sock.h> #include <net/request_sock.h>
#include <linux/atomic.h> #include <linux/refcount.h>
struct cipso_v4_doi; struct cipso_v4_doi;
struct calipso_doi; struct calipso_doi;
@ -136,7 +136,7 @@ struct netlbl_audit {
* *
*/ */
struct netlbl_lsm_cache { struct netlbl_lsm_cache {
atomic_t refcount; refcount_t refcount;
void (*free) (const void *data); void (*free) (const void *data);
void *data; void *data;
}; };
@ -295,7 +295,7 @@ static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags)
cache = kzalloc(sizeof(*cache), flags); cache = kzalloc(sizeof(*cache), flags);
if (cache) if (cache)
atomic_set(&cache->refcount, 1); refcount_set(&cache->refcount, 1);
return cache; return cache;
} }
@ -309,7 +309,7 @@ static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags)
*/ */
static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache) static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache)
{ {
if (!atomic_dec_and_test(&cache->refcount)) if (!refcount_dec_and_test(&cache->refcount))
return; return;
if (cache->free) if (cache->free)

4
net/ipv4/cipso_ipv4.c
View File

@ -265,7 +265,7 @@ static int cipso_v4_cache_check(const unsigned char *key,
entry->key_len == key_len && entry->key_len == key_len &&
memcmp(entry->key, key, key_len) == 0) { memcmp(entry->key, key, key_len) == 0) {
entry->activity += 1; entry->activity += 1;
atomic_inc(&entry->lsm_data->refcount); refcount_inc(&entry->lsm_data->refcount);
secattr->cache = entry->lsm_data; secattr->cache = entry->lsm_data;
secattr->flags |= NETLBL_SECATTR_CACHE; secattr->flags |= NETLBL_SECATTR_CACHE;
secattr->type = NETLBL_NLTYPE_CIPSOV4; secattr->type = NETLBL_NLTYPE_CIPSOV4;
@ -332,7 +332,7 @@ int cipso_v4_cache_add(const unsigned char *cipso_ptr,
} }
entry->key_len = cipso_ptr_len; entry->key_len = cipso_ptr_len;
entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len); entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
atomic_inc(&secattr->cache->refcount); refcount_inc(&secattr->cache->refcount);
entry->lsm_data = secattr->cache; entry->lsm_data = secattr->cache;
bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1); bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);

4
net/ipv6/calipso.c
View File

@ -227,7 +227,7 @@ static int calipso_cache_check(const unsigned char *key,
entry->key_len == key_len && entry->key_len == key_len &&
memcmp(entry->key, key, key_len) == 0) { memcmp(entry->key, key, key_len) == 0) {
entry->activity += 1; entry->activity += 1;
atomic_inc(&entry->lsm_data->refcount); refcount_inc(&entry->lsm_data->refcount);
secattr->cache = entry->lsm_data; secattr->cache = entry->lsm_data;
secattr->flags |= NETLBL_SECATTR_CACHE; secattr->flags |= NETLBL_SECATTR_CACHE;
secattr->type = NETLBL_NLTYPE_CALIPSO; secattr->type = NETLBL_NLTYPE_CALIPSO;
@ -296,7 +296,7 @@ static int calipso_cache_add(const unsigned char *calipso_ptr,
} }
entry->key_len = calipso_ptr_len; entry->key_len = calipso_ptr_len;
entry->hash = calipso_map_cache_hash(calipso_ptr, calipso_ptr_len); entry->hash = calipso_map_cache_hash(calipso_ptr, calipso_ptr_len);
atomic_inc(&secattr->cache->refcount); refcount_inc(&secattr->cache->refcount);
entry->lsm_data = secattr->cache; entry->lsm_data = secattr->cache;
bkt = entry->hash & (CALIPSO_CACHE_BUCKETS - 1); bkt = entry->hash & (CALIPSO_CACHE_BUCKETS - 1);