Bluetooth: convert rfcomm_dlc.refcnt from atomic_t to refcount_t
authorElena Reshetova <elena.reshetova@intel.com>
Fri, 17 Mar 2017 11:12:46 +0000 (13:12 +0200)
committerMarcel Holtmann <marcel@holtmann.org>
Wed, 12 Apr 2017 20:02:36 +0000 (22:02 +0200)
commitdab6b5daeeb3e70bfb2ed2d6d6f02dd387e3b338
treef53267726421189109c1e348965ac84e4281ac5c
parent9232259913022c1ab96f7bf2b87598b89b942f1f
Bluetooth: convert rfcomm_dlc.refcnt from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
include/net/bluetooth/rfcomm.h
net/bluetooth/rfcomm/core.c