btrfs: convert extent_map.refs from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 27fdb250b446..3649932e48d5 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2859,7 +2859,7 @@ __get_extent_map(struct inode *inode, struct page *page, size_t pg_offset,
                 em = *em_cached;
                 if (extent_map_in_tree(em) && start >= em->start &&
                     start < extent_map_end(em)) {
-                        atomic_inc(&em->refs);
+                        refcount_inc(&em->refs);
                         return em;
                 }
 
@@ -2870,7 +2870,7 @@ __get_extent_map(struct inode *inode, struct page *page, size_t pg_offset,
         em = get_extent(BTRFS_I(inode), page, pg_offset, start, len, 0);
         if (em_cached && !IS_ERR_OR_NULL(em)) {
                 BUG_ON(*em_cached);
-                atomic_inc(&em->refs);
+                refcount_inc(&em->refs);
                 *em_cached = em;
         }
         return em;