net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 4d7c855d84430736617654bf97e98c870aa314f8..0dfc5c14b6965b67c320218e174b2d8790b7d8ed 100644 (file)
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -524,7 +524,7 @@ int sctp_chunk_abandoned(struct sctp_chunk *);
 struct sctp_chunk {
        struct list_head list;
 
-       atomic_t refcnt;
+       refcount_t refcnt;
 
        /* How many times this chunk have been sent, for prsctp RTX policy */
        int sent_count;

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 3af4dd024ec00abd095e3b9a0367aeb61aa13e9e..4e16b02ed8321fcbd022cee0ed2c9d9c90d422a6 100644 (file)
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1345,7 +1345,7 @@ struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
        INIT_LIST_HEAD(&retval->transmitted_list);
        INIT_LIST_HEAD(&retval->frag_list);
        SCTP_DBG_OBJCNT_INC(chunk);
-       atomic_set(&retval->refcnt, 1);
+       refcount_set(&retval->refcnt, 1);
 
 nodata:
        return retval;
@@ -1458,13 +1458,13 @@ void sctp_chunk_free(struct sctp_chunk *chunk)
 /* Grab a reference to the chunk. */
 void sctp_chunk_hold(struct sctp_chunk *ch)
 {
-       atomic_inc(&ch->refcnt);
+       refcount_inc(&ch->refcnt);
 }
 
 /* Release a reference to the chunk. */
 void sctp_chunk_put(struct sctp_chunk *ch)
 {
-       if (atomic_dec_and_test(&ch->refcnt))
+       if (refcount_dec_and_test(&ch->refcnt))
                sctp_chunk_destroy(ch);
 }