Skip to content
  • Elena Reshetova's avatar
    drivers, connector: convert cn_callback_entry.refcnt from atomic_t to refcount_t · e65f7ee3
    Elena Reshetova authored
    
    
    atomic_t variables are currently used to implement reference
    counters with the following properties:
     - counter is initialized to 1 using atomic_set()
     - a resource is freed upon counter reaching zero
     - once counter reaches zero, its further
       increments aren't allowed
     - counter schema uses basic atomic operations
       (set, inc, inc_not_zero, dec_and_test, etc.)
    
    Such atomic variables should be converted to a newly provided
    refcount_t type and API that prevents accidental counter overflows
    and underflows. This is important since overflows and underflows
    can lead to use-after-free situation and be exploitable.
    
    The variable cn_callback_entry.refcnt is used as pure reference counter.
    Convert it to refcount_t and fix up the operations.
    
    Suggested-by: default avatarKees Cook <keescook@chromium.org>
    Reviewed-by: default avatarDavid Windsor <dwindsor@gmail.com>
    Reviewed-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
    Signed-off-by: Elena Reshetova <elena.resheto...
    e65f7ee3