Petr Pavlu f91f7ac900 refcount: Report UAF for refcount_sub_and_test(0) when counter==0
When a reference counter is at zero and refcount_sub_and_test() is invoked
to subtract zero, the function accepts this request without any warning and
returns true. This behavior does not seem ideal because the counter being
already at zero indicates a use-after-free. Furthermore, returning true by
refcount_sub_and_test() in this case potentially results in a double-free
done by its caller.

Modify the underlying function __refcount_sub_and_test() to warn about this
case as a use-after-free and have it return false to avoid the potential
double-free.

Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20240717130023.5675-1-petr.pavlu@suse.com
Signed-off-by: Kees Cook <kees@kernel.org>
2024-08-05 14:34:23 -07:00
..
2023-10-27 14:43:10 -07:00
2024-05-18 12:39:20 -07:00
2020-12-09 15:51:14 +01:00
2022-09-26 10:13:14 -07:00