refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations.
Signed-off-by: Elena Reshetova <[email protected]> Signed-off-by: Hans Liljestrand <[email protected]> Signed-off-by: Kees Cook <[email protected]> Signed-off-by: David Windsor <[email protected]> --- fs/afs/internal.h | 4 ++-- fs/afs/volume.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 127567c..8f05daf 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -302,7 +302,7 @@ struct afs_server { * AFS volume access record */ struct afs_volume { - atomic_t usage; + refcount_t usage; struct afs_cell *cell; /* cell to which belongs (unrefd ptr) */ struct afs_vlocation *vlocation; /* volume location */ #ifdef CONFIG_AFS_FSCACHE @@ -694,7 +694,7 @@ extern int afs_vnode_release_lock(struct afs_vnode *, struct key *); /* * volume.c */ -#define afs_get_volume(V) do { atomic_inc(&(V)->usage); } while(0) +#define afs_get_volume(V) do { refcount_inc(&(V)->usage); } while(0) extern void afs_put_volume(struct afs_volume *); extern struct afs_volume *afs_volume_lookup(struct afs_mount_params *); diff --git a/fs/afs/volume.c b/fs/afs/volume.c index 546f9d0..6590606 100644 --- a/fs/afs/volume.c +++ b/fs/afs/volume.c @@ -100,7 +100,7 @@ struct afs_volume *afs_volume_lookup(struct afs_mount_params *params) if (!volume) goto error_up; - atomic_set(&volume->usage, 1); + refcount_set(&volume->usage, 1); volume->type = params->type; volume->type_force = params->force; volume->cell = params->cell; @@ -180,7 +180,7 @@ void afs_put_volume(struct afs_volume *volume) _enter("%p", volume); - ASSERTCMP(atomic_read(&volume->usage), >, 0); + ASSERTCMP(refcount_read(&volume->usage), >, 0); vlocation = volume->vlocation; @@ -188,7 +188,7 @@ void afs_put_volume(struct afs_volume *volume) * atomic */ down_write(&vlocation->cell->vl_sem); - if (likely(!atomic_dec_and_test(&volume->usage))) { + if (likely(!refcount_dec_and_test(&volume->usage))) { up_write(&vlocation->cell->vl_sem); _leave(""); return; -- 2.7.4
