net: convert neighbour.refcnt from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 3 deletions

diff --git a/net/atm/clip.c b/net/atm/clip.c
index a7e4018370b4..47c36f449df0 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -137,11 +137,11 @@ static int neigh_check_cb(struct neighbour *n)
         if (entry->vccs || time_before(jiffies, entry->expires))
                 return 0;
 
-        if (atomic_read(&n->refcnt) > 1) {
+        if (refcount_read(&n->refcnt) > 1) {
                 struct sk_buff *skb;
 
                 pr_debug("destruction postponed with ref %d\n",
-                         atomic_read(&n->refcnt));
+                         refcount_read(&n->refcnt));
 
                 while ((skb = skb_dequeue(&n->arp_queue)) != NULL)
                         dev_kfree_skb(skb);
@@ -767,7 +767,7 @@ static void atmarp_info(struct seq_file *seq, struct neighbour *n,
                         seq_printf(seq, "(resolving)\n");
                 else
                         seq_printf(seq, "(expired, ref %d)\n",
-                                   atomic_read(&entry->neigh->refcnt));
+                                   refcount_read(&entry->neigh->refcnt));
         } else if (!svc) {
                 seq_printf(seq, "%d.%d.%d\n",
                            clip_vcc->vcc->dev->number,