net: convert sk_buff.users from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 5 deletions

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 005793e01bd2..90cbd86152da 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -761,7 +761,7 @@ struct sk_buff {
         unsigned char           *head,
                                 *data;
         unsigned int            truesize;
-        atomic_t                users;
+        refcount_t              users;
 };
 
 #ifdef __KERNEL__
@@ -872,9 +872,9 @@ static inline bool skb_unref(struct sk_buff *skb)
 {
         if (unlikely(!skb))
                 return false;
-        if (likely(atomic_read(&skb->users) == 1))
+        if (likely(refcount_read(&skb->users) == 1))
                 smp_rmb();
-        else if (likely(!atomic_dec_and_test(&skb->users)))
+        else if (likely(!refcount_dec_and_test(&skb->users)))
                 return false;
 
         return true;
@@ -1283,7 +1283,7 @@ static inline struct sk_buff *skb_queue_prev(const struct sk_buff_head *list,
  */
 static inline struct sk_buff *skb_get(struct sk_buff *skb)
 {
-        atomic_inc(&skb->users);
+        refcount_inc(&skb->users);
         return skb;
 }
 
@@ -1384,7 +1384,7 @@ static inline void __skb_header_release(struct sk_buff *skb)
  */
 static inline int skb_shared(const struct sk_buff *skb)
 {
-        return atomic_read(&skb->users) != 1;
+        return refcount_read(&skb->users) != 1;
 }
 
 /**