net, sctp: convert sctp_datamsg.refcnt from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 07c11fefa8c49fee9d9b5a668241b14a3fdf6058..4d7c855d84430736617654bf97e98c870aa314f8 100644 (file)
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -496,7 +496,7 @@ struct sctp_datamsg {
        /* Chunks waiting to be submitted to lower layer. */
        struct list_head chunks;
        /* Reference counting. */
-       atomic_t refcnt;
+       refcount_t refcnt;
        /* When is this message no longer interesting to the peer? */
        unsigned long expires_at;
        /* Did the messenge fail to send? */

diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 81466f6442e89fe2c0a9ff44d30645627812e54c..1323d41e68b82e9cb826dbc3112709db3e0166c9 100644 (file)
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -49,7 +49,7 @@
 /* Initialize datamsg from memory. */
 static void sctp_datamsg_init(struct sctp_datamsg *msg)
 {
-       atomic_set(&msg->refcnt, 1);
+       refcount_set(&msg->refcnt, 1);
        msg->send_failed = 0;
        msg->send_error = 0;
        msg->can_delay = 1;
@@ -136,13 +136,13 @@ static void sctp_datamsg_destroy(struct sctp_datamsg *msg)
 /* Hold a reference. */
 static void sctp_datamsg_hold(struct sctp_datamsg *msg)
 {
-       atomic_inc(&msg->refcnt);
+       refcount_inc(&msg->refcnt);
 }
 
 /* Release a reference. */
 void sctp_datamsg_put(struct sctp_datamsg *msg)
 {
-       if (atomic_dec_and_test(&msg->refcnt))
+       if (refcount_dec_and_test(&msg->refcnt))
                sctp_datamsg_destroy(msg);
 }