Unverified Commit 474c3b02 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3659 atm: Fix Use-After-Free in do_vcc_ioctl 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/BUEIBN3CE7Y4S2BVYQBQEF3L3HLQ3QQL/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8RXNR 
 
Link:https://gitee.com/openeuler/kernel/pulls/3659

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 081df9e1 6e409b9d

net/atm/ioctl.c

+5 −2
Original line number Diff line number Diff line
@@ -73,14 +73,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, 
	case SIOCINQ:

	{

		struct sk_buff *skb;

		int amount;



		if (sock->state != SS_CONNECTED) {

			error = -EINVAL;

			goto done;

		}

		spin_lock_irq(&sk->sk_receive_queue.lock);

		skb = skb_peek(&sk->sk_receive_queue);

		error = put_user(skb ? skb->len : 0,

				 (int __user *)argp) ? -EFAULT : 0;

		amount = skb ? skb->len : 0;

		spin_unlock_irq(&sk->sk_receive_queue.lock);

		error = put_user(amount, (int __user *)argp) ? -EFAULT : 0;

		goto done;

	}

	case ATM_SETSC: