Unverified Commit 2d032cb8 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3716 appletalk: Fix Use-After-Free in atalk_ioctl 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZHM2AP5MYDNZ2ZPGALDTGQYYYWT36JIE/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8RXOY 
 
Link:https://gitee.com/openeuler/kernel/pulls/3716

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 64aa7242 865c6290

net/appletalk/ddp.c

+4 −5
Original line number Diff line number Diff line
@@ -1799,15 +1799,14 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 
		break;

	}

	case TIOCINQ: {

		/*

		 * These two are safe on a single CPU system as only

		 * user tasks fiddle here

		 */

		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);

		struct sk_buff *skb;

		long amount = 0;



		spin_lock_irq(&sk->sk_receive_queue.lock);

		skb = skb_peek(&sk->sk_receive_queue);

		if (skb)

			amount = skb->len - sizeof(struct ddpehdr);

		spin_unlock_irq(&sk->sk_receive_queue.lock);

		rc = put_user(amount, (int __user *)argp);

		break;

	}