mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
appletalk: Fix Use-After-Free in atalk_ioctl
[ Upstream commit189ff16722
] Because atalk_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with atalk_recvmsg(). A use-after-free for skb occurs with the following flow. ``` atalk_ioctl() -> skb_peek() atalk_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() ``` Add sk->sk_receive_queue.lock to atalk_ioctl() to fix this issue. Fixes:1da177e4c3
("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Link: https://lore.kernel.org/r/20231213041056.GA519680@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
ad2ecbdc29
commit
0686da1ada
1 changed files with 4 additions and 5 deletions
|
@ -1810,15 +1810,14 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case TIOCINQ: {
|
case TIOCINQ: {
|
||||||
/*
|
struct sk_buff *skb;
|
||||||
* These two are safe on a single CPU system as only
|
|
||||||
* user tasks fiddle here
|
|
||||||
*/
|
|
||||||
struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
|
|
||||||
long amount = 0;
|
long amount = 0;
|
||||||
|
|
||||||
|
spin_lock_irq(&sk->sk_receive_queue.lock);
|
||||||
|
skb = skb_peek(&sk->sk_receive_queue);
|
||||||
if (skb)
|
if (skb)
|
||||||
amount = skb->len - sizeof(struct ddpehdr);
|
amount = skb->len - sizeof(struct ddpehdr);
|
||||||
|
spin_unlock_irq(&sk->sk_receive_queue.lock);
|
||||||
rc = put_user(amount, (int __user *)argp);
|
rc = put_user(amount, (int __user *)argp);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue