Unverified Commit 67e00fea authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3660 atm: Fix Use-After-Free in do_vcc_ioctl 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/KOTFVULL6H3GSVDXMFXA5LQQ2OBK5BUL/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8RXNR 
 
Link:https://gitee.com/openeuler/kernel/pulls/3660

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 27c99427 114a7062

net/atm/ioctl.c

+5 −2
Original line number Diff line number Diff line
@@ -71,14 +71,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, 
	case SIOCINQ:

	{

		struct sk_buff *skb;

		int amount;



		if (sock->state != SS_CONNECTED) {

			error = -EINVAL;

			goto done;

		}

		spin_lock_irq(&sk->sk_receive_queue.lock);

		skb = skb_peek(&sk->sk_receive_queue);

		error = put_user(skb ? skb->len : 0,

				 (int __user *)argp) ? -EFAULT : 0;

		amount = skb ? skb->len : 0;

		spin_unlock_irq(&sk->sk_receive_queue.lock);

		error = put_user(amount, (int __user *)argp) ? -EFAULT : 0;

		goto done;

	}

	case SIOCGSTAMP: /* borrowed from IP */