From patchwork Tue Feb 21 15:27:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Reshetova, Elena" X-Patchwork-Id: 9588375 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C50956057F for ; Thu, 23 Feb 2017 14:25:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B326628760 for ; Thu, 23 Feb 2017 14:25:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A7B6C28761; Thu, 23 Feb 2017 14:25:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE autolearn=unavailable version=3.3.1 Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ADF9F28763 for ; Thu, 23 Feb 2017 14:25:40 +0000 (UTC) Received: from alsa0.perex.cz (localhost [127.0.0.1]) by alsa0.perex.cz (Postfix) with ESMTP id 4E160266AD4; Thu, 23 Feb 2017 15:09:15 +0100 (CET) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id A73B82666EA; Tue, 21 Feb 2017 16:27:26 +0100 (CET) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by alsa0.perex.cz (Postfix) with ESMTP id E481C2666EA for ; Tue, 21 Feb 2017 16:27:21 +0100 (CET) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Feb 2017 07:27:20 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos; i="5.35,190,1484035200"; d="scan'208"; a="1113666047" Received: from michalrx-mobl.ger.corp.intel.com (HELO elena-ThinkPad-X230.ger.corp.intel.com) ([10.249.39.9]) by fmsmga001.fm.intel.com with ESMTP; 21 Feb 2017 07:27:17 -0800 From: Elena Reshetova To: linux-kernel@vger.kernel.org Date: Tue, 21 Feb 2017 17:27:10 +0200 Message-Id: <1487690830-30277-1-git-send-email-elena.reshetova@intel.com> X-Mailer: git-send-email 2.7.4 X-Mailman-Approved-At: Thu, 23 Feb 2017 15:09:07 +0100 Cc: alsa-devel@alsa-project.org, Kees Cook , peterz@infradead.org, gregkh@linuxfoundation.org, tiwai@suse.com, Hans Liljestrand , Elena Reshetova , David Windsor Subject: [alsa-devel] [PATCH] sound: convert snd_seq_subscribers.ref_count from atomic_t to refcount_t X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor --- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_ports.c | 7 +++---- sound/core/seq/seq_ports.h | 3 ++- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 4c93520..3440f76 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -666,7 +666,7 @@ static int deliver_to_subscribers(struct snd_seq_client *client, down_read(&grp->list_mutex); list_for_each_entry(subs, &grp->list_head, src_list) { /* both ports ready? */ - if (atomic_read(&subs->ref_count) != 2) + if (refcount_read(&subs->ref_count) != 2) continue; event->dest = subs->info.dest; if (subs->info.flags & SNDRV_SEQ_PORT_SUBS_TIMESTAMP) diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c index fe686ee..1ca896b 100644 --- a/sound/core/seq/seq_ports.c +++ b/sound/core/seq/seq_ports.c @@ -241,7 +241,7 @@ static void clear_subscriber_list(struct snd_seq_client *client, * we decrease the counter, and when both ports are deleted * remove the subscriber info */ - if (atomic_dec_and_test(&subs->ref_count)) + if (refcount_dec_and_test(&subs->ref_count)) kfree(subs); continue; } @@ -520,7 +520,6 @@ static int check_and_subscribe_port(struct snd_seq_client *client, else list_add_tail(&subs->dest_list, &grp->list_head); grp->exclusive = exclusive; - atomic_inc(&subs->ref_count); write_unlock_irq(&grp->list_lock); err = 0; @@ -570,7 +569,6 @@ int snd_seq_port_connect(struct snd_seq_client *connector, return -ENOMEM; subs->info = *info; - atomic_set(&subs->ref_count, 0); INIT_LIST_HEAD(&subs->src_list); INIT_LIST_HEAD(&subs->dest_list); @@ -587,6 +585,7 @@ int snd_seq_port_connect(struct snd_seq_client *connector, if (err < 0) goto error_dest; + refcount_set(&subs->ref_count, 2); return 0; error_dest: @@ -613,7 +612,7 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector, /* look for the connection */ list_for_each_entry(subs, &src->list_head, src_list) { if (match_subs_info(info, &subs->info)) { - atomic_dec(&subs->ref_count); /* mark as not ready */ + refcount_dec(&subs->ref_count); /* mark as not ready */ err = 0; break; } diff --git a/sound/core/seq/seq_ports.h b/sound/core/seq/seq_ports.h index 26bd71f..d09e396 100644 --- a/sound/core/seq/seq_ports.h +++ b/sound/core/seq/seq_ports.h @@ -21,6 +21,7 @@ #ifndef __SND_SEQ_PORTS_H #define __SND_SEQ_PORTS_H +#include #include #include "seq_lock.h" @@ -44,7 +45,7 @@ struct snd_seq_subscribers { struct snd_seq_port_subscribe info; /* additional info */ struct list_head src_list; /* link of sources */ struct list_head dest_list; /* link of destinations */ - atomic_t ref_count; + refcount_t ref_count; }; struct snd_seq_port_subs_info {