diff options
| author | Reshetova, Elena <elena.reshetova@intel.com> | 2017-06-30 13:07:58 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-07-01 07:39:07 -0700 |
| commit | 633547973ffc32fd2c815639d4675e1531f0896f (patch) | |
| tree | 751ca7a379366af93f578d9f35f48339d4d2dd9b /include/linux/skbuff.h | |
| parent | 53869cebce4bc53f71a080e7830600d4ae1ab712 (diff) | |
net: convert sk_buff.users from atomic_t to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/skbuff.h')
| -rw-r--r-- | include/linux/skbuff.h | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 005793e01bd2..90cbd86152da 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -761,7 +761,7 @@ struct sk_buff { unsigned char *head, *data; unsigned int truesize; - atomic_t users; + refcount_t users; }; #ifdef __KERNEL__ @@ -872,9 +872,9 @@ static inline bool skb_unref(struct sk_buff *skb) { if (unlikely(!skb)) return false; - if (likely(atomic_read(&skb->users) == 1)) + if (likely(refcount_read(&skb->users) == 1)) smp_rmb(); - else if (likely(!atomic_dec_and_test(&skb->users))) + else if (likely(!refcount_dec_and_test(&skb->users))) return false; return true; @@ -1283,7 +1283,7 @@ static inline struct sk_buff *skb_queue_prev(const struct sk_buff_head *list, */ static inline struct sk_buff *skb_get(struct sk_buff *skb) { - atomic_inc(&skb->users); + refcount_inc(&skb->users); return skb; } @@ -1384,7 +1384,7 @@ static inline void __skb_header_release(struct sk_buff *skb) */ static inline int skb_shared(const struct sk_buff *skb) { - return atomic_read(&skb->users) != 1; + return refcount_read(&skb->users) != 1; } /** |