summary refs log tree commit diff
path: root/include/scsi
diff options
context:
space:
mode:
authorElena Reshetova <elena.reshetova@intel.com>2017-03-09 13:46:58 +0200
committerMartin K. Petersen <martin.petersen@oracle.com>2017-03-15 18:44:39 -0400
commit6dc618cdd6b896791313926becb1f86ede0e046a (patch)
treee4b0637932e6f5ce980720b12fc253e6bfcf2b74 /include/scsi
parent22c70d1a9c639b432ffdf083bea44752ad9fc8f3 (diff)
downloadlinux-6dc618cdd6b896791313926becb1f86ede0e046a.tar.gz
scsi: libiscsi: qedi: convert iscsi_task.refcount from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t
when the variable is used as a reference counter. This allows to avoid
accidental refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Acked-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'include/scsi')
-rw-r--r--include/scsi/libiscsi.h3
1 files changed, 2 insertions, 1 deletions
diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
index b0e275de6dec..24d74b5bcb24 100644
--- a/include/scsi/libiscsi.h
+++ b/include/scsi/libiscsi.h
@@ -29,6 +29,7 @@
 #include <linux/timer.h>
 #include <linux/workqueue.h>
 #include <linux/kfifo.h>
+#include <linux/refcount.h>
 #include <scsi/iscsi_proto.h>
 #include <scsi/iscsi_if.h>
 #include <scsi/scsi_transport_iscsi.h>
@@ -139,7 +140,7 @@ struct iscsi_task {
 
 	/* state set/tested under session->lock */
 	int			state;
-	atomic_t		refcount;
+	refcount_t		refcount;
 	struct list_head	running;	/* running cmd list */
 	void			*dd_data;	/* driver/transport data */
 };