> Hi Elena, > > On Mon, Mar 06, 2017 at 04:20:59PM +0200, Elena Reshetova wrote: > > refcount_t type and corresponding API should be > > used instead of atomic_t when the variable is used as > > a reference counter. This allows to avoid accidental > > refcounter overflows that might lead to use-after-free > > situations. > > > > Signed-off-by: Elena Reshetova <elena.reshetova@xxxxxxxxx> > > Signed-off-by: Hans Liljestrand <ishkamiel@xxxxxxxxx> > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > > Signed-off-by: David Windsor <dwindsor@xxxxxxxxx> > > --- > ... > > @@ -1688,7 +1689,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev) > > "failed to register > video device!\n"); > > break; > > } > > - atomic_inc(&dev->num_channels); > > + refcount_set(&dev->num_channels, 1); > > That's not right. The loop runs four iterations and the value after the > loop should be indeed the number of channels. Oh, yes, I was blind here, sorry. The problem why it cannot be left as inc is because it would do increment from zero here, which is not allowed by refcount_t interface. > atomic_t isn't really used for reference counting here, but storing out how > many "channels" there are per hardware device, with maximum number of four > (4). I'd leave this driver using atomic_t. Yes, sounds like the best thing to do. I will drop this patch. Thank you for reviews! Best Regards, Elena. > > > v4l2_info(&dev->v4l2_dev, "V4L2 device registered > as %s\n", > > video_device_node_name(&vc- > >vdev)); > > > > -- > Kind regards, > > Sakari Ailus > e-mail: sakari.ailus@xxxxxx XMPP: sailus@xxxxxxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
