phonet/pep: fix racy skb_queue_empty() use
mainline inclusion from mainline-v6.8-rc6 commit 7d2a894d7f487dcb894df023e9d3014cf5b93fe5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LU CVE: CVE-2024-27402 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7d2a894d7f487dcb894df023e9d3014cf5b93fe5 -------------------------------- The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skb_peek() unexpectedly returning NULL or a pointer to an already dequeued socket buffer. Fixes: 9641458d ("Phonet: Pipe End Point for Phonet Pipes protocol") Signed-off-by:Rémi Denis-Courmont <courmisch@gmail.com> Link: https://lore.kernel.org/r/20240218081214.4806-2-remi@remlab.net Signed-off-by:
Paolo Abeni <pabeni@redhat.com> Conflicts: net/phonet/pep.c [ Context conflict ] Signed-off-by:
Yipeng Zou <zouyipeng@huawei.com>
Loading
Please sign in to comment