Unverified Commit c28ee72a authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1655 can: bcm: Fix UAF in bcm_proc_show() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/7EQSQN64OKQD5VUXFEKT6K4XAFZ52LBI/ 
 
https://gitee.com/openeuler/kernel/issues/I7R1N4 
 
Link:https://gitee.com/openeuler/kernel/pulls/1655

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
parents e25d3df9 c1aa7aa1

net/can/bcm.c

+6 −6
Original line number Diff line number Diff line
@@ -1506,6 +1506,12 @@ static int bcm_release(struct socket *sock) 


	lock_sock(sk);



#if IS_ENABLED(CONFIG_PROC_FS)

	/* remove procfs entry */

	if (net->can.bcmproc_dir && bo->bcm_proc_read)

		remove_proc_entry(bo->procname, net->can.bcmproc_dir);

#endif /* CONFIG_PROC_FS */



	list_for_each_entry_safe(op, next, &bo->tx_ops, list)

		bcm_remove_op(op);
@@ -1541,12 +1547,6 @@ static int bcm_release(struct socket *sock) 
	list_for_each_entry_safe(op, next, &bo->rx_ops, list)

		bcm_remove_op(op);



#if IS_ENABLED(CONFIG_PROC_FS)

	/* remove procfs entry */

	if (net->can.bcmproc_dir && bo->bcm_proc_read)

		remove_proc_entry(bo->procname, net->can.bcmproc_dir);

#endif /* CONFIG_PROC_FS */



	/* remove device reference */

	if (bo->bound) {

		bo->bound   = 0;