summaryrefslogtreecommitdiffstats
path: root/net/atm
diff options
context:
space:
mode:
authorHyunwoo Kim <v4bel@theori.io>2023-12-09 10:42:10 +0100
committerPaolo Abeni <pabeni@redhat.com>2023-12-12 13:14:08 +0100
commit24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 (patch)
tree8d978d27ee13819541f7e98293c33f0f792c38b3 /net/atm
parentocteontx2-af: Fix pause frame configuration (diff)
downloadlinux-24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3.tar.xz
linux-24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3.zip
atm: Fix Use-After-Free in do_vcc_ioctl
Because do_vcc_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with vcc_recvmsg(). A use-after-free for skb occurs with the following flow. ``` do_vcc_ioctl() -> skb_peek() vcc_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() ``` Add sk->sk_receive_queue.lock to do_vcc_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Link: https://lore.kernel.org/r/20231209094210.GA403126@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/atm')
-rw-r--r--net/atm/ioctl.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 838ebf0cabbf..f81f8d56f5c0 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -73,14 +73,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd,
case SIOCINQ:
{
struct sk_buff *skb;
+ int amount;
if (sock->state != SS_CONNECTED) {
error = -EINVAL;
goto done;
}
+ spin_lock_irq(&sk->sk_receive_queue.lock);
skb = skb_peek(&sk->sk_receive_queue);
- error = put_user(skb ? skb->len : 0,
- (int __user *)argp) ? -EFAULT : 0;
+ amount = skb ? skb->len : 0;
+ spin_unlock_irq(&sk->sk_receive_queue.lock);
+ error = put_user(amount, (int __user *)argp) ? -EFAULT : 0;
goto done;
}
case ATM_SETSC: