[Xen-devel] [PATCH 12/29] drivers, media: convert s2255_dev.num_channels from atomic_t to refcount_t

[Elena Reshetova <elena.reshetova@xxxxxxxxx>]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@xxxxxxxxx>
Signed-off-by: Hans Liljestrand <ishkamiel@xxxxxxxxx>
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Signed-off-by: David Windsor <dwindsor@xxxxxxxxx>
---
 drivers/media/usb/s2255/s2255drv.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/drivers/media/usb/s2255/s2255drv.c 
b/drivers/media/usb/s2255/s2255drv.c
index a9d4484..2b4b009 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -36,6 +36,7 @@
 #include <linux/firmware.h>
 #include <linux/kernel.h>
 #include <linux/mutex.h>
+#include <linux/refcount.h>
 #include <linux/slab.h>
 #include <linux/videodev2.h>
 #include <linux/mm.h>
@@ -256,7 +257,7 @@ struct s2255_vc {
 struct s2255_dev {
        struct s2255_vc         vc[MAX_CHANNELS];
        struct v4l2_device      v4l2_dev;
-       atomic_t                num_channels;
+       refcount_t                num_channels;
        int                     frames;
        struct mutex            lock;   /* channels[].vdev.lock */
        struct mutex            cmdlock; /* protects cmdbuf */
@@ -1581,11 +1582,11 @@ static void s2255_video_device_release(struct 
video_device *vdev)
                container_of(vdev, struct s2255_vc, vdev);
 
        dprintk(dev, 4, "%s, chnls: %d\n", __func__,
-               atomic_read(&dev->num_channels));
+               refcount_read(&dev->num_channels));
 
        v4l2_ctrl_handler_free(&vc->hdl);
 
-       if (atomic_dec_and_test(&dev->num_channels))
+       if (refcount_dec_and_test(&dev->num_channels))
                s2255_destroy(dev);
        return;
 }
@@ -1688,7 +1689,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
                                "failed to register video device!\n");
                        break;
                }
-               atomic_inc(&dev->num_channels);
+               refcount_set(&dev->num_channels, 1);
                v4l2_info(&dev->v4l2_dev, "V4L2 device registered as %s\n",
                          video_device_node_name(&vc->vdev));
 
@@ -1696,11 +1697,11 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
        pr_info("Sensoray 2255 V4L driver Revision: %s\n",
                S2255_VERSION);
        /* if no channels registered, return error and probe will fail*/
-       if (atomic_read(&dev->num_channels) == 0) {
+       if (refcount_read(&dev->num_channels) == 0) {
                v4l2_device_unregister(&dev->v4l2_dev);
                return ret;
        }
-       if (atomic_read(&dev->num_channels) != MAX_CHANNELS)
+       if (refcount_read(&dev->num_channels) != MAX_CHANNELS)
                pr_warn("s2255: Not all channels available.\n");
        return 0;
 }
@@ -2248,7 +2249,7 @@ static int s2255_probe(struct usb_interface *interface,
                goto errorFWDATA1;
        }
 
-       atomic_set(&dev->num_channels, 0);
+       refcount_set(&dev->num_channels, 0);
        dev->pid = id->idProduct;
        dev->fw_data = kzalloc(sizeof(struct s2255_fw), GFP_KERNEL);
        if (!dev->fw_data)
@@ -2368,12 +2369,12 @@ static void s2255_disconnect(struct usb_interface 
*interface)
 {
        struct s2255_dev *dev = to_s2255_dev(usb_get_intfdata(interface));
        int i;
-       int channels = atomic_read(&dev->num_channels);
+       int channels = refcount_read(&dev->num_channels);
        mutex_lock(&dev->lock);
        v4l2_device_disconnect(&dev->v4l2_dev);
        mutex_unlock(&dev->lock);
        /*see comments in the uvc_driver.c usb disconnect function */
-       atomic_inc(&dev->num_channels);
+       refcount_inc(&dev->num_channels);
        /* unregister each video device. */
        for (i = 0; i < channels; i++)
                video_unregister_device(&dev->vc[i].vdev);
@@ -2386,7 +2387,7 @@ static void s2255_disconnect(struct usb_interface 
*interface)
                dev->vc[i].vidstatus_ready = 1;
                wake_up(&dev->vc[i].wait_vidstatus);
        }
-       if (atomic_dec_and_test(&dev->num_channels))
+       if (refcount_dec_and_test(&dev->num_channels))
                s2255_destroy(dev);
        dev_info(&interface->dev, "%s\n", __func__);
 }
-- 
2.7.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel