refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations.
Signed-off-by: Elena Reshetova <[email protected]> Signed-off-by: Hans Liljestrand <[email protected]> Signed-off-by: Kees Cook <[email protected]> Signed-off-by: David Windsor <[email protected]> --- fs/nfs/dir.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c index fad8104..0c95d2b 100644 --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -145,7 +145,7 @@ struct nfs_cache_array_entry { }; struct nfs_cache_array { - atomic_t refcount; + refcount_t refcount; int size; int eof_index; u64 last_cookie; @@ -201,7 +201,7 @@ void nfs_readdir_clear_array(struct page *page) int i; array = kmap_atomic(page); - if (atomic_dec_and_test(&array->refcount)) + if (refcount_dec_and_test(&array->refcount)) for (i = 0; i < array->size; i++) kfree(array->array[i].string.name); kunmap_atomic(array); @@ -210,7 +210,7 @@ void nfs_readdir_clear_array(struct page *page) static bool grab_page(struct page *page) { struct nfs_cache_array *array = kmap_atomic(page); - bool res = atomic_inc_not_zero(&array->refcount); + bool res = refcount_inc_not_zero(&array->refcount); kunmap_atomic(array); return res; } @@ -680,7 +680,7 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page, goto out_label_free; } memset(array, 0, sizeof(struct nfs_cache_array)); - atomic_set(&array->refcount, 1); + refcount_set(&array->refcount, 1); array->eof_index = -1; status = nfs_readdir_alloc_pages(pages, array_size); -- 2.7.4
