diff options
| author | Reshetova, Elena <elena.reshetova@intel.com> | 2017-06-30 12:07:55 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-07-01 16:39:07 +0200 |
| commit | 9f23743017d11c103b38d2fa1f64674baeca41cd (patch) | |
| tree | 272ef703abacf82daa5059b911f2a52159734294 /include/net/neighbour.h | |
| parent | net: convert inet_peer.refcnt from atomic_t to refcount_t (diff) | |
| download | linux-9f23743017d11c103b38d2fa1f64674baeca41cd.tar.xz linux-9f23743017d11c103b38d2fa1f64674baeca41cd.zip | |
net: convert neighbour.refcnt from atomic_t to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/neighbour.h')
| -rw-r--r-- | include/net/neighbour.h | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/include/net/neighbour.h b/include/net/neighbour.h index 639b67564a7d..e5ee739d2b8c 100644 --- a/include/net/neighbour.h +++ b/include/net/neighbour.h @@ -17,6 +17,7 @@ */ #include <linux/atomic.h> +#include <linux/refcount.h> #include <linux/netdevice.h> #include <linux/skbuff.h> #include <linux/rcupdate.h> @@ -137,7 +138,7 @@ struct neighbour { unsigned long confirmed; unsigned long updated; rwlock_t lock; - atomic_t refcnt; + refcount_t refcnt; struct sk_buff_head arp_queue; unsigned int arp_queue_len_bytes; struct timer_list timer; @@ -410,18 +411,18 @@ static inline struct neigh_parms *neigh_parms_clone(struct neigh_parms *parms) static inline void neigh_release(struct neighbour *neigh) { - if (atomic_dec_and_test(&neigh->refcnt)) + if (refcount_dec_and_test(&neigh->refcnt)) neigh_destroy(neigh); } static inline struct neighbour * neigh_clone(struct neighbour *neigh) { if (neigh) - atomic_inc(&neigh->refcnt); + refcount_inc(&neigh->refcnt); return neigh; } -#define neigh_hold(n) atomic_inc(&(n)->refcnt) +#define neigh_hold(n) refcount_inc(&(n)->refcnt) static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) { |