diff options
| author | Elena Reshetova <elena.reshetova@intel.com> | 2017-03-17 14:12:46 +0300 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2017-04-12 23:02:36 +0300 |
| commit | dab6b5daeeb3e70bfb2ed2d6d6f02dd387e3b338 (patch) | |
| tree | f53267726421189109c1e348965ac84e4281ac5c /include/net/bluetooth/rfcomm.h | |
| parent | 9232259913022c1ab96f7bf2b87598b89b942f1f (diff) | |
| download | linux-dab6b5daeeb3e70bfb2ed2d6d6f02dd387e3b338.tar.xz | |
Bluetooth: convert rfcomm_dlc.refcnt from atomic_t to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'include/net/bluetooth/rfcomm.h')
| -rw-r--r-- | include/net/bluetooth/rfcomm.h | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h index 4190af53a46a..da4acefe39c8 100644 --- a/include/net/bluetooth/rfcomm.h +++ b/include/net/bluetooth/rfcomm.h @@ -21,6 +21,8 @@ SOFTWARE IS DISCLAIMED. */ +#include <linux/refcount.h> + #ifndef __RFCOMM_H #define __RFCOMM_H @@ -174,7 +176,7 @@ struct rfcomm_dlc { struct mutex lock; unsigned long state; unsigned long flags; - atomic_t refcnt; + refcount_t refcnt; u8 dlci; u8 addr; u8 priority; @@ -247,12 +249,12 @@ struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel); static inline void rfcomm_dlc_hold(struct rfcomm_dlc *d) { - atomic_inc(&d->refcnt); + refcount_inc(&d->refcnt); } static inline void rfcomm_dlc_put(struct rfcomm_dlc *d) { - if (atomic_dec_and_test(&d->refcnt)) + if (refcount_dec_and_test(&d->refcnt)) rfcomm_dlc_free(d); } |