refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations.
Unified · Split
| @@ -124,7 +124,7 @@ static struct fw_node *fw_node_create(u32 sid, int port_count, int color) · 123 unmodified lines | |||
| 124 | node->initiated_reset = SELF_ID_PHY_INITIATOR(sid); | 124 | node->initiated_reset = SELF_ID_PHY_INITIATOR(sid); |
| 125 | node->port_count = port_count; | 125 | node->port_count = port_count; |
| 126 | 126 | ||
| 127 | atomic_set(&node->ref_count, 1); | 127 | refcount_set(&node->ref_count, 1); |
| 128 | INIT_LIST_HEAD(&node->link); | 128 | INIT_LIST_HEAD(&node->link); |
| 129 | 129 | ||
| 130 | return node; | 130 | return node; |
| @@ -12,7 +12,7 @@ · 11 unmodified lines | |||
| 12 | #include <linux/slab.h> | 12 | #include <linux/slab.h> |
| 13 | #include <linux/types.h> | 13 | #include <linux/types.h> |
| 14 | 14 | ||
| 15 | #include <linux/atomic.h> | 15 | #include <linux/refcount.h> |
| 16 | 16 | ||
| 17 | struct device; | 17 | struct device; |
| 18 | struct fw_card; | 18 | struct fw_card; |
| @@ -184,7 +184,7 @@ struct fw_node { · 165 unmodified lines | |||
| 184 | * local node to this node. */ | 184 | * local node to this node. */ |
| 185 | u8 max_depth:4; /* Maximum depth to any leaf node */ | 185 | u8 max_depth:4; /* Maximum depth to any leaf node */ |
| 186 | u8 max_hops:4; /* Max hops in this sub tree */ | 186 | u8 max_hops:4; /* Max hops in this sub tree */ |
| 187 | atomic_t ref_count; | 187 | refcount_t ref_count; |
| 188 | 188 | ||
| 189 | /* For serializing node topology into a list. */ | 189 | /* For serializing node topology into a list. */ |
| 190 | struct list_head link; | 190 | struct list_head link; |
| @@ -197,14 +197,14 @@ struct fw_node { · 6 unmodified lines | |||
| 197 | 197 | ||
| 198 | static inline struct fw_node *fw_node_get(struct fw_node *node) | 198 | static inline struct fw_node *fw_node_get(struct fw_node *node) |
| 199 | { | 199 | { |
| 200 | atomic_inc(&node->ref_count); | 200 | refcount_inc(&node->ref_count); |
| 201 | 201 | ||
| 202 | return node; | 202 | return node; |
| 203 | } | 203 | } |
| 204 | 204 | ||
| 205 | static inline void fw_node_put(struct fw_node *node) | 205 | static inline void fw_node_put(struct fw_node *node) |
| 206 | { | 206 | { |
| 207 | if (atomic_dec_and_test(&node->ref_count)) | 207 | if (refcount_dec_and_test(&node->ref_count)) |
| 208 | kfree(node); | 208 | kfree(node); |
| 209 | } | 209 | } |
| 210 | 210 | ||