net: convert (struct ubuf_info)->refcnt to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

v2: added the change in drivers/vhost/net.c as spotted
by Willem.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ba08b78ed630c429ccf415af69bf27f2433af4f0..8d2bcae53a2ec9ea1c876625e581bcd429abe365 100644 (file)
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -533,7 +533,7 @@ static void handle_tx(struct vhost_net *net)
                        ubuf->callback = vhost_zerocopy_callback;
                        ubuf->ctx = nvq->ubufs;
                        ubuf->desc = nvq->upend_idx;
-                       atomic_set(&ubuf->refcnt, 1);
+                       refcount_set(&ubuf->refcnt, 1);
                        msg.msg_control = ubuf;
                        msg.msg_controllen = sizeof(ubuf);
                        ubufs = nvq->ubufs;

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index f93cc01064cb720d4ddf76c363044d1a6c62b68b..f751f3b930391d02b7b0f2c2d3852de64b46b920 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -22,6 +22,7 @@
 #include <linux/cache.h>
 #include <linux/rbtree.h>
 #include <linux/socket.h>
+#include <linux/refcount.h>
 
 #include <linux/atomic.h>
 #include <asm/types.h>
@@ -456,7 +457,7 @@ struct ubuf_info {
                        u32 bytelen;
                };
        };
-       atomic_t refcnt;
+       refcount_t refcnt;
 
        struct mmpin {
                struct user_struct *user;
@@ -472,7 +473,7 @@ struct ubuf_info *sock_zerocopy_realloc(struct sock *sk, size_t size,
 
 static inline void sock_zerocopy_get(struct ubuf_info *uarg)
 {
-       atomic_inc(&uarg->refcnt);
+       refcount_inc(&uarg->refcnt);
 }
 
 void sock_zerocopy_put(struct ubuf_info *uarg);

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a003f953a0a633e088165eb9097ecda6d68747b7..68065d7d383fa6bb477ac690a926d9d86db65bc9 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -963,7 +963,7 @@ struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size)
        uarg->len = 1;
        uarg->bytelen = size;
        uarg->zerocopy = 1;
-       atomic_set(&uarg->refcnt, 1);
+       refcount_set(&uarg->refcnt, 1);
        sock_hold(sk);
 
        return uarg;
@@ -1086,7 +1086,7 @@ EXPORT_SYMBOL_GPL(sock_zerocopy_callback);
 
 void sock_zerocopy_put(struct ubuf_info *uarg)
 {
-       if (uarg && atomic_dec_and_test(&uarg->refcnt)) {
+       if (uarg && refcount_dec_and_test(&uarg->refcnt)) {
                if (uarg->callback)
                        uarg->callback(uarg, uarg->zerocopy);
                else
@@ -1483,7 +1483,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                if (skb_orphan_frags(skb, gfp_mask))
                        goto nofrags;
                if (skb_zcopy(skb))
-                       atomic_inc(&skb_uarg(skb)->refcnt);
+                       refcount_inc(&skb_uarg(skb)->refcnt);
                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
                        skb_frag_ref(skb, i);