Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752739AbdGGJAV (ORCPT ); Fri, 7 Jul 2017 05:00:21 -0400 Received: from mga02.intel.com ([134.134.136.20]:55349 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751834AbdGGJAT (ORCPT ); Fri, 7 Jul 2017 05:00:19 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.40,321,1496127600"; d="scan'208";a="284084936" From: Elena Reshetova To: linux-kernel@vger.kernel.org Cc: peterz@infradead.org, gregkh@linuxfoundation.org, akpm@linux-foundation.org, ebiederm@xmission.com, mingo@redhat.com, adobriyan@gmail.com, serge@hallyn.com, arozansk@redhat.com, dave@stgolabs.net, keescook@chromium.org, Elena Reshetova , Hans Liljestrand , David Windsor Subject: [PATCH 3/3] ipc: convert kern_ipc_perm.refcount from atomic_t to refcount_t Date: Fri, 7 Jul 2017 11:59:52 +0300 Message-Id: <1499417992-3238-4-git-send-email-elena.reshetova@intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1499417992-3238-1-git-send-email-elena.reshetova@intel.com> References: <1499417992-3238-1-git-send-email-elena.reshetova@intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1955 Lines: 67 refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor --- include/linux/ipc.h | 3 ++- ipc/util.c | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/include/linux/ipc.h b/include/linux/ipc.h index fadd579..ae68980 100644 --- a/include/linux/ipc.h +++ b/include/linux/ipc.h @@ -4,6 +4,7 @@ #include #include #include +#include #define IPCMNI 32768 /* <= MAX_INT limit for ipc arrays (including sysctl changes) */ @@ -22,7 +23,7 @@ struct kern_ipc_perm { void *security; struct rcu_head rcu; - atomic_t refcount; + refcount_t refcount; } ____cacheline_aligned_in_smp __randomize_layout; #endif /* _LINUX_IPC_H */ diff --git a/ipc/util.c b/ipc/util.c index 1a2cb02..069bb22 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -232,7 +232,7 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size) idr_preload(GFP_KERNEL); - atomic_set(&new->refcount, 1); + refcount_set(&new->refcount, 1); spin_lock_init(&new->lock); new->deleted = false; rcu_read_lock(); @@ -397,13 +397,13 @@ void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp) int ipc_rcu_getref(struct kern_ipc_perm *ptr) { - return atomic_inc_not_zero(&ptr->refcount); + return refcount_inc_not_zero(&ptr->refcount); } void ipc_rcu_putref(struct kern_ipc_perm *ptr, void (*func)(struct rcu_head *head)) { - if (!atomic_dec_and_test(&ptr->refcount)) + if (!refcount_dec_and_test(&ptr->refcount)) return; call_rcu(&ptr->rcu, func); -- 2.7.4