forked from Minki/linux
eaf6ab7643
atomic_t variables are currently used to implement reference counters with the following properties: - counter is initialized to 1 using atomic_set() - a resource is freed upon counter reaching zero - once counter reaches zero, its further increments aren't allowed - counter schema uses basic atomic operations (set, inc, inc_not_zero, dec_and_test, etc.) Such atomic variables should be converted to a newly provided refcount_t type and API that prevents accidental counter overflows and underflows. This is important since overflows and underflows can lead to use-after-free situation and be exploitable. The variable clip_entry.refcnt is used as pure reference counter. Convert it to refcount_t and fix up the operations. Suggested-by: Kees Cook <keescook@chromium.org> Reviewed-by: David Windsor <dwindsor@gmail.com> Reviewed-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
46 lines
1.3 KiB
C
46 lines
1.3 KiB
C
/*
|
|
* This file is part of the Chelsio T4 Ethernet driver for Linux.
|
|
* Copyright (C) 2003-2014 Chelsio Communications. All rights reserved.
|
|
*
|
|
* Written by Deepak (deepak.s@chelsio.com)
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the LICENSE file included in this
|
|
* release for licensing terms and conditions.
|
|
*/
|
|
|
|
#include <linux/refcount.h>
|
|
|
|
struct clip_entry {
|
|
spinlock_t lock; /* Hold while modifying clip reference */
|
|
refcount_t refcnt;
|
|
struct list_head list;
|
|
union {
|
|
struct sockaddr_in addr;
|
|
struct sockaddr_in6 addr6;
|
|
};
|
|
};
|
|
|
|
struct clip_tbl {
|
|
unsigned int clipt_start;
|
|
unsigned int clipt_size;
|
|
rwlock_t lock;
|
|
atomic_t nfree;
|
|
struct list_head ce_free_head;
|
|
void *cl_list;
|
|
struct list_head hash_list[0];
|
|
};
|
|
|
|
enum {
|
|
CLIPT_MIN_HASH_BUCKETS = 2,
|
|
};
|
|
|
|
struct clip_tbl *t4_init_clip_tbl(unsigned int clipt_start,
|
|
unsigned int clipt_end);
|
|
int cxgb4_clip_get(const struct net_device *dev, const u32 *lip, u8 v6);
|
|
void cxgb4_clip_release(const struct net_device *dev, const u32 *lip, u8 v6);
|
|
int clip_tbl_show(struct seq_file *seq, void *v);
|
|
int cxgb4_update_root_dev_clip(struct net_device *dev);
|
|
void t4_cleanup_clip_tbl(struct adapter *adap);
|