diff options
| author | David S. Miller <[email protected]> | 2019-04-23 17:19:48 -0700 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2019-04-23 17:19:48 -0700 |
| commit | 6b18bdfdba2cb11c26f06dea6bacfd6d43a37c88 (patch) | |
| tree | 0b5cbc74ef48d5d571ded7c8971d30df7740c035 /include | |
| parent | 20eb08b2b06bf1cf5e5dda2e5212db893c3e8ffe (diff) | |
| parent | f05713e0916ca46f127641b6afa74bd1a0772423 (diff) | |
Merge branch 'ipv6-fib6_ref-conversion-to-refcount_t'
Eric Dumazet says:
====================
ipv6: fib6_ref conversion to refcount_t
We are chasing use-after-free in IPv6 that could have their origin
in fib6_ref 0 -> 1 transitions.
This patch series should help finding the root causes if these
illegal transitions ever happen.
====================
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/ip6_fib.h | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h index 352f767bea81..5a4a67b38712 100644 --- a/include/net/ip6_fib.h +++ b/include/net/ip6_fib.h @@ -146,7 +146,7 @@ struct fib6_info { struct list_head fib6_siblings; unsigned int fib6_nsiblings; - atomic_t fib6_ref; + refcount_t fib6_ref; unsigned long expires; struct dst_metrics *fib6_metrics; #define fib6_pmtu fib6_metrics->metrics[RTAX_MTU-1] @@ -284,17 +284,17 @@ void fib6_info_destroy_rcu(struct rcu_head *head); static inline void fib6_info_hold(struct fib6_info *f6i) { - atomic_inc(&f6i->fib6_ref); + refcount_inc(&f6i->fib6_ref); } static inline bool fib6_info_hold_safe(struct fib6_info *f6i) { - return atomic_inc_not_zero(&f6i->fib6_ref); + return refcount_inc_not_zero(&f6i->fib6_ref); } static inline void fib6_info_release(struct fib6_info *f6i) { - if (f6i && atomic_dec_and_test(&f6i->fib6_ref)) + if (f6i && refcount_dec_and_test(&f6i->fib6_ref)) call_rcu(&f6i->rcu, fib6_info_destroy_rcu); } |