atomic_t variables are currently used to implement reference counters with the following properties: - counter is initialized to 1 using atomic_set() - a resource is freed upon counter reaching zero - once counter reaches zero, its further increments aren't allowed - counter schema uses basic atomic operations (set, inc, inc_not_zero, dec_and_test, etc.)
Such atomic variables should be converted to a newly provided refcount_t type and API that prevents accidental counter overflows and underflows. This is important since overflows and underflows can lead to use-after-free situation and be exploitable. The variable ncp_request_reply.refs is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook <[email protected]> Reviewed-by: David Windsor <[email protected]> Reviewed-by: Hans Liljestrand <[email protected]> Signed-off-by: Elena Reshetova <[email protected]> --- fs/ncpfs/sock.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ncpfs/sock.c b/fs/ncpfs/sock.c index 98b6db0..523d864 100644 --- a/fs/ncpfs/sock.c +++ b/fs/ncpfs/sock.c @@ -29,6 +29,7 @@ #include <linux/ipx.h> #include <linux/poll.h> #include <linux/file.h> +#include <linux/refcount.h> #include "ncp_fs.h" @@ -52,7 +53,7 @@ static int _send(struct socket *sock, const void *buff, int len) struct ncp_request_reply { struct list_head req; wait_queue_head_t wq; - atomic_t refs; + refcount_t refs; unsigned char* reply_buf; size_t datalen; int result; @@ -72,7 +73,7 @@ static inline struct ncp_request_reply* ncp_alloc_req(void) return NULL; init_waitqueue_head(&req->wq); - atomic_set(&req->refs, (1)); + refcount_set(&req->refs, (1)); req->status = RQ_IDLE; return req; @@ -80,12 +81,12 @@ static inline struct ncp_request_reply* ncp_alloc_req(void) static void ncp_req_get(struct ncp_request_reply *req) { - atomic_inc(&req->refs); + refcount_inc(&req->refs); } static void ncp_req_put(struct ncp_request_reply *req) { - if (atomic_dec_and_test(&req->refs)) + if (refcount_dec_and_test(&req->refs)) kfree(req); } -- 2.7.4
