Hyunwoo Kim 580ff9f59a appletalk: Fix Use-After-Free in atalk_ioctl ...

[ Upstream commit 189ff16722 ]

Because atalk_ioctl() accesses sk->sk_receive_queue
without holding a sk->sk_receive_queue.lock, it can
cause a race with atalk_recvmsg().
A use-after-free for skb occurs with the following flow.
```
atalk_ioctl() -> skb_peek()
atalk_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
```
Add sk->sk_receive_queue.lock to atalk_ioctl() to fix this issue.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Link: https://lore.kernel.org/r/20231213041056.GA519680@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-12-20 15:38:01 +01:00

..

aarp.c

appletalk: Fix potential NULL pointer dereference in unregister_snap_client

2019-12-13 08:52:59 +01:00

atalk_proc.c

appletalk: Fix use-after-free in atalk_proc_exit

2019-04-20 09:16:05 +02:00

ddp.c

appletalk: Fix Use-After-Free in atalk_ioctl

2023-12-20 15:38:01 +01:00

dev.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Makefile

…

sysctl_net_atalk.c

appletalk: Fix use-after-free in atalk_proc_exit

2019-04-20 09:16:05 +02:00