diff options
| author | Reshetova, Elena <elena.reshetova@intel.com> | 2017-06-30 13:07:54 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-07-01 17:39:07 +0300 |
| commit | 1cc9a98b59ba92fece1277f76aa43e05f34936a6 (patch) | |
| tree | faaa05ab4da5bd6a3e284759117f036aeb8faabd /include/net/inetpeer.h | |
| parent | 574a60208794d97ce571db93797f30c36ab38425 (diff) | |
| download | linux-1cc9a98b59ba92fece1277f76aa43e05f34936a6.tar.xz | |
net: convert inet_peer.refcnt from atomic_t to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
This conversion requires overall +1 on the whole
refcounting scheme.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/inetpeer.h')
| -rw-r--r-- | include/net/inetpeer.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h index 235c7811a86a..f2a215fc78e4 100644 --- a/include/net/inetpeer.h +++ b/include/net/inetpeer.h @@ -46,7 +46,7 @@ struct inet_peer { struct rcu_head gc_rcu; }; /* - * Once inet_peer is queued for deletion (refcnt == -1), following field + * Once inet_peer is queued for deletion (refcnt == 0), following field * is not available: rid * We can share memory with rcu_head to help keep inet_peer small. */ @@ -60,7 +60,7 @@ struct inet_peer { /* following fields might be frequently dirtied */ __u32 dtime; /* the time of last use of not referenced entries */ - atomic_t refcnt; + refcount_t refcnt; }; struct inet_peer_base { |