Unverified Commit 2380c87d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3668 net/rose: Fix Use-After-Free in rose_ioctl 

Merge Pull Request from: @ci-robot 
 
PR sync from: Lu Wei <luwei32@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/7W3QPUDCJLV33NJJQ6MHPWY5LWGDGVS6/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8RXMW 
 
Link:https://gitee.com/openeuler/kernel/pulls/3668

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 6cb3706d 74e69053

net/rose/af_rose.c

+3 −1
Original line number Diff line number Diff line
@@ -1307,9 +1307,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 
	case TIOCINQ: {

		struct sk_buff *skb;

		long amount = 0L;

		/* These two are safe on a single CPU system as only user tasks fiddle here */



		spin_lock_irq(&sk->sk_receive_queue.lock);

		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)

			amount = skb->len;

		spin_unlock_irq(&sk->sk_receive_queue.lock);

		return put_user(amount, (unsigned int __user *) argp);

	}