Commit 07f144f1 authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont Committed by Jinjie Ruan
Browse files

phonet/pep: fix racy skb_queue_empty() use

mainline inclusion
from mainline-v6.8-rc6
commit 7d2a894d7f487dcb894df023e9d3014cf5b93fe5
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LU
CVE: CVE-2024-27402

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7d2a894d7f487dcb894df023e9d3014cf5b93fe5



--------------------------------

The receive queues are protected by their respective spin-lock, not
the socket lock. This could lead to skb_peek() unexpectedly
returning NULL or a pointer to an already dequeued socket buffer.

Fixes: 9641458d ("Phonet: Pipe End Point for Phonet Pipes protocol")
Signed-off-by: default avatarRémi Denis-Courmont <courmisch@gmail.com>
Link: https://lore.kernel.org/r/20240218081214.4806-2-remi@remlab.net


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>

Conflicts:
	net/phonet/pep.c
[ Context conflict ]
Signed-off-by: default avatarYipeng Zou <zouyipeng@huawei.com>
parent 0a378cfa
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment