xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: convert rfcomm_dlc.refcnt from atomic_t to refcount_t

Browse Source 
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Elena Reshetova
2017-03-17 13:12:46 +02:00
committed by Marcel Holtmann
parent 9232259913
commit dab6b5daee
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/net/bluetooth/rfcomm.h
View File

@@ -21,6 +21,8 @@
SOFTWARE IS DISCLAIMED.
*/
#include <linux/refcount.h>
#ifndef __RFCOMM_H
#define __RFCOMM_H
@@ -174,7 +176,7 @@ struct rfcomm_dlc {
struct mutex lock;
unsigned long state;
unsigned long flags;
atomic_t refcnt;
refcount_t refcnt;
u8 dlci;
u8 addr;
u8 priority;
@@ -247,12 +249,12 @@ struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel);
static inline void rfcomm_dlc_hold(struct rfcomm_dlc *d)
{
atomic_inc(&d->refcnt);
refcount_inc(&d->refcnt);
}
static inline void rfcomm_dlc_put(struct rfcomm_dlc *d)
{
if (atomic_dec_and_test(&d->refcnt))
if (refcount_dec_and_test(&d->refcnt))
rfcomm_dlc_free(d);
}