diff options
| author | Reshetova, Elena <[email protected]> | 2017-06-30 13:07:59 +0300 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2017-07-01 07:39:08 -0700 |
| commit | 2638595afccf6554bfe55268ff9b2d3ac3dff2e6 (patch) | |
| tree | 958d39026bc292e6048824012fdcb46f3a70d7e9 /include/linux | |
| parent | 633547973ffc32fd2c815639d4675e1531f0896f (diff) | |
net: convert sk_buff_fclones.fclone_ref from atomic_t to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <[email protected]>
Signed-off-by: Hans Liljestrand <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
Signed-off-by: David Windsor <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/skbuff.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 90cbd86152da..d0b9f3846eab 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -915,7 +915,7 @@ struct sk_buff_fclones { struct sk_buff skb2; - atomic_t fclone_ref; + refcount_t fclone_ref; }; /** @@ -935,7 +935,7 @@ static inline bool skb_fclone_busy(const struct sock *sk, fclones = container_of(skb, struct sk_buff_fclones, skb1); return skb->fclone == SKB_FCLONE_ORIG && - atomic_read(&fclones->fclone_ref) > 1 && + refcount_read(&fclones->fclone_ref) > 1 && fclones->skb2.sk == sk; } |