refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations.
Unified · Split
| @@ -124,7 +124,7 @@ static struct fw_node *fw_node_create(u32 sid, int port_count, int color) · 123 unmodified lines | ||
| 124 | 124 | node->initiated_reset = SELF_ID_PHY_INITIATOR(sid); |
| 125 | 125 | node->port_count = port_count; |
| 126 | 126 | |
| 127 | − atomic_set(&node->ref_count, 1); | |
| 127 | + refcount_set(&node->ref_count, 1); | |
| 128 | 128 | INIT_LIST_HEAD(&node->link); |
| 129 | 129 | |
| 130 | 130 | return node; |
| @@ -12,7 +12,7 @@ · 11 unmodified lines | ||
| 12 | 12 | #include <linux/slab.h> |
| 13 | 13 | #include <linux/types.h> |
| 14 | 14 | |
| 15 | −#include <linux/atomic.h> | |
| 15 | +#include <linux/refcount.h> | |
| 16 | 16 | |
| 17 | 17 | struct device; |
| 18 | 18 | struct fw_card; |
| @@ -184,7 +184,7 @@ struct fw_node { · 165 unmodified lines | ||
| 184 | 184 | * local node to this node. */ |
| 185 | 185 | u8 max_depth:4; /* Maximum depth to any leaf node */ |
| 186 | 186 | u8 max_hops:4; /* Max hops in this sub tree */ |
| 187 | − atomic_t ref_count; | |
| 187 | + refcount_t ref_count; | |
| 188 | 188 | |
| 189 | 189 | /* For serializing node topology into a list. */ |
| 190 | 190 | struct list_head link; |
| @@ -197,14 +197,14 @@ struct fw_node { · 6 unmodified lines | ||
| 197 | 197 | |
| 198 | 198 | static inline struct fw_node *fw_node_get(struct fw_node *node) |
| 199 | 199 | { |
| 200 | − atomic_inc(&node->ref_count); | |
| 200 | + refcount_inc(&node->ref_count); | |
| 201 | 201 | |
| 202 | 202 | return node; |
| 203 | 203 | } |
| 204 | 204 | |
| 205 | 205 | static inline void fw_node_put(struct fw_node *node) |
| 206 | 206 | { |
| 207 | − if (atomic_dec_and_test(&node->ref_count)) | |
| 207 | + if (refcount_dec_and_test(&node->ref_count)) | |
| 208 | 208 | kfree(node); |
| 209 | 209 | } |
| 210 | 210 | |