Unverified Commit 263d6128 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3988 [sync] PR-3715: appletalk: Fix Use-After-Free in atalk_ioctl 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/3715 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QXWWUG2SWY7UNYOYX7I5TNHPVOSMXBAJ/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8RXOY 
 
Link:https://gitee.com/openeuler/kernel/pulls/3988

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 03399a7e 32cfce3d

net/appletalk/ddp.c

+4 −5
Original line number Diff line number Diff line
@@ -1811,15 +1811,14 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 
		break;

	}

	case TIOCINQ: {

		/*

		 * These two are safe on a single CPU system as only

		 * user tasks fiddle here

		 */

		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);

		struct sk_buff *skb;

		long amount = 0;



		spin_lock_irq(&sk->sk_receive_queue.lock);

		skb = skb_peek(&sk->sk_receive_queue);

		if (skb)

			amount = skb->len - sizeof(struct ddpehdr);

		spin_unlock_irq(&sk->sk_receive_queue.lock);

		rc = put_user(amount, (int __user *)argp);

		break;

	}