net, l2tp: convert l2tp_session.ref_count from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 203c4aa3e916c887c83609d5baadb72c34273dc2..b0c2d4ae781d2114cdb09269d27768f0632a1776 100644 (file)
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1854,7 +1854,7 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
                /* Bump the reference count. The session context is deleted
                 * only when this drops to zero.
                 */
-               l2tp_session_inc_refcount(session);
+               refcount_set(&session->ref_count, 1);
                l2tp_tunnel_inc_refcount(tunnel);
 
                /* Ensure tunnel socket isn't deleted */

diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index da58fad2451b7f4b9cb08f74f7e5e8a321acbc97..cdb6e3327f744040f8510ad0882c2f620509dfb9 100644 (file)
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -99,7 +99,7 @@ struct l2tp_session {
        int                     nr_oos_count;   /* For OOS recovery */
        int                     nr_oos_count_max;
        struct hlist_node       hlist;          /* Hash list node */
-       atomic_t                ref_count;
+       refcount_t              ref_count;
 
        char                    name[32];       /* for logging */
        char                    ifname[IFNAMSIZ];
@@ -274,12 +274,12 @@ int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
  */
 static inline void l2tp_session_inc_refcount_1(struct l2tp_session *session)
 {
-       atomic_inc(&session->ref_count);
+       refcount_inc(&session->ref_count);
 }
 
 static inline void l2tp_session_dec_refcount_1(struct l2tp_session *session)
 {
-       if (atomic_dec_and_test(&session->ref_count))
+       if (refcount_dec_and_test(&session->ref_count))
                l2tp_session_free(session);
 }
 
@@ -288,14 +288,14 @@ static inline void l2tp_session_dec_refcount_1(struct l2tp_session *session)
 do {                                                                   \
        pr_debug("l2tp_session_inc_refcount: %s:%d %s: cnt=%d\n",       \
                 __func__, __LINE__, (_s)->name,                        \
-                atomic_read(&_s->ref_count));                          \
+                refcount_read(&_s->ref_count));                        \
        l2tp_session_inc_refcount_1(_s);                                \
 } while (0)
 #define l2tp_session_dec_refcount(_s)                                  \
 do {                                                                   \
        pr_debug("l2tp_session_dec_refcount: %s:%d %s: cnt=%d\n",       \
                 __func__, __LINE__, (_s)->name,                        \
-                atomic_read(&_s->ref_count));                          \
+                refcount_read(&_s->ref_count));                        \
        l2tp_session_dec_refcount_1(_s);                                \
 } while (0)
 #else