net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 3 deletions

diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index f9058ebeb635..f9f6fb3f3c5b 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -389,7 +389,7 @@ link_it:
         }
 
         fi->fib_treeref++;
-        atomic_inc(&fi->fib_clntref);
+        refcount_set(&fi->fib_clntref, 1);
         spin_lock(&dn_fib_info_lock);
         fi->fib_next = dn_fib_info_list;
         fi->fib_prev = NULL;
@@ -425,7 +425,7 @@ int dn_fib_semantic_match(int type, struct dn_fib_info *fi, const struct flowidn
                 switch (type) {
                 case RTN_NAT:
                         DN_FIB_RES_RESET(*res);
-                        atomic_inc(&fi->fib_clntref);
+                        refcount_inc(&fi->fib_clntref);
                         return 0;
                 case RTN_UNICAST:
                 case RTN_LOCAL:
@@ -438,7 +438,7 @@ int dn_fib_semantic_match(int type, struct dn_fib_info *fi, const struct flowidn
                         }
                         if (nhsel < fi->fib_nhs) {
                                 res->nh_sel = nhsel;
-                                atomic_inc(&fi->fib_clntref);
+                                refcount_inc(&fi->fib_clntref);
                                 return 0;
                         }
                         endfor_nexthops(fi);