]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
phonet/pep: fix racy skb_queue_empty() use
authorRémi Denis-Courmont <courmisch@gmail.com>
Mon, 14 Apr 2025 18:50:20 +0000 (11:50 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 2 May 2025 05:44:18 +0000 (07:44 +0200)
commit7d3914a477eed92b48c493a8631cc4554ab4fd4f
tree902fa57bf267a59aa42b3d2b24a6e82b785e59de
parent6cc52df69e8464811f9f6fc12f7aaa78451eb0b8
phonet/pep: fix racy skb_queue_empty() use

[ Upstream commit 7d2a894d7f487dcb894df023e9d3014cf5b93fe5 ]

The receive queues are protected by their respective spin-lock, not
the socket lock. This could lead to skb_peek() unexpectedly
returning NULL or a pointer to an already dequeued socket buffer.

Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol")
Signed-off-by: Rémi Denis-Courmont <courmisch@gmail.com>
Link: https://lore.kernel.org/r/20240218081214.4806-2-remi@remlab.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[Harshit: backport to 5.15.y, clean cherrypick from 6.1.y commit]
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/phonet/pep.c