net, sunrpc: convert gss_upcall_msg.count from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 72f129c74acdf3a911dd6caf981b06edfcb0523a..9463af4b32e8d7d688523986c584e73046d4dd7a 100644 (file)
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -287,7 +287,7 @@ err:
 #define UPCALL_BUF_LEN 128
 
 struct gss_upcall_msg {
-       atomic_t count;
+       refcount_t count;
        kuid_t  uid;
        struct rpc_pipe_msg msg;
        struct list_head list;
@@ -328,7 +328,7 @@ static void
 gss_release_msg(struct gss_upcall_msg *gss_msg)
 {
        struct net *net = gss_msg->auth->net;
-       if (!atomic_dec_and_test(&gss_msg->count))
+       if (!refcount_dec_and_test(&gss_msg->count))
                return;
        put_pipe_version(net);
        BUG_ON(!list_empty(&gss_msg->list));
@@ -348,7 +348,7 @@ __gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth
                        continue;
                if (auth && pos->auth->service != auth->service)
                        continue;
-               atomic_inc(&pos->count);
+               refcount_inc(&pos->count);
                dprintk("RPC:       %s found msg %p\n", __func__, pos);
                return pos;
        }
@@ -369,7 +369,7 @@ gss_add_msg(struct gss_upcall_msg *gss_msg)
        spin_lock(&pipe->lock);
        old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
        if (old == NULL) {
-               atomic_inc(&gss_msg->count);
+               refcount_inc(&gss_msg->count);
                list_add(&gss_msg->list, &pipe->in_downcall);
        } else
                gss_msg = old;
@@ -383,7 +383,7 @@ __gss_unhash_msg(struct gss_upcall_msg *gss_msg)
        list_del_init(&gss_msg->list);
        rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
        wake_up_all(&gss_msg->waitqueue);
-       atomic_dec(&gss_msg->count);
+       refcount_dec(&gss_msg->count);
 }
 
 static void
@@ -506,7 +506,7 @@ gss_alloc_msg(struct gss_auth *gss_auth,
        INIT_LIST_HEAD(&gss_msg->list);
        rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
        init_waitqueue_head(&gss_msg->waitqueue);
-       atomic_set(&gss_msg->count, 1);
+       refcount_set(&gss_msg->count, 1);
        gss_msg->uid = uid;
        gss_msg->auth = gss_auth;
        switch (vers) {
@@ -542,11 +542,11 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
        gss_msg = gss_add_msg(gss_new);
        if (gss_msg == gss_new) {
                int res;
-               atomic_inc(&gss_msg->count);
+               refcount_inc(&gss_msg->count);
                res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
                if (res) {
                        gss_unhash_msg(gss_new);
-                       atomic_dec(&gss_msg->count);
+                       refcount_dec(&gss_msg->count);
                        gss_release_msg(gss_new);
                        gss_msg = ERR_PTR(res);
                }
@@ -595,7 +595,7 @@ gss_refresh_upcall(struct rpc_task *task)
                task->tk_timeout = 0;
                gss_cred->gc_upcall = gss_msg;
                /* gss_upcall_callback will release the reference to gss_upcall_msg */
-               atomic_inc(&gss_msg->count);
+               refcount_inc(&gss_msg->count);
                rpc_sleep_on(&gss_msg->rpc_waitqueue, task, gss_upcall_callback);
        } else {
                gss_handle_downcall_result(gss_cred, gss_msg);
@@ -815,7 +815,7 @@ restart:
                if (!list_empty(&gss_msg->msg.list))
                        continue;
                gss_msg->msg.errno = -EPIPE;
-               atomic_inc(&gss_msg->count);
+               refcount_inc(&gss_msg->count);
                __gss_unhash_msg(gss_msg);
                spin_unlock(&pipe->lock);
                gss_release_msg(gss_msg);
@@ -834,7 +834,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
        if (msg->errno < 0) {
                dprintk("RPC:       %s releasing msg %p\n",
                        __func__, gss_msg);
-               atomic_inc(&gss_msg->count);
+               refcount_inc(&gss_msg->count);
                gss_unhash_msg(gss_msg);
                if (msg->errno == -ETIMEDOUT)
                        warn_gssd();