diff options
| author | Eric Dumazet <edumazet@google.com> | 2017-08-31 16:48:22 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-09-01 20:22:03 -0700 |
| commit | c1d1b437816f0afa99202be3cb650c9d174667bc (patch) | |
| tree | 14ee9ec0f2e759bb237b2a010aa56989874cc054 /drivers/vhost/net.c | |
| parent | db5bce32fbe19f0c7482fb5a40a33178bbe7b11b (diff) | |
net: convert (struct ubuf_info)->refcnt to refcount_t
refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
v2: added the change in drivers/vhost/net.c as spotted
by Willem.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/vhost/net.c')
| -rw-r--r-- | drivers/vhost/net.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index ba08b78ed630..8d2bcae53a2e 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -533,7 +533,7 @@ static void handle_tx(struct vhost_net *net) ubuf->callback = vhost_zerocopy_callback; ubuf->ctx = nvq->ubufs; ubuf->desc = nvq->upend_idx; - atomic_set(&ubuf->refcnt, 1); + refcount_set(&ubuf->refcnt, 1); msg.msg_control = ubuf; msg.msg_controllen = sizeof(ubuf); ubufs = nvq->ubufs; |