Message ID | 20240117222555.51460-2-yuxuan.luo@canonical.com |
---|---|
State | New |
Headers | show |
Series | CVE-2023-51782 | expand |
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c index 6fb158172ddc2..fc9ef08788f73 100644 --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -1285,9 +1285,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) case TIOCINQ: { struct sk_buff *skb; long amount = 0L; - /* These two are safe on a single CPU system as only user tasks fiddle here */ + + spin_lock_irq(&sk->sk_receive_queue.lock); if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) amount = skb->len; + spin_unlock_irq(&sk->sk_receive_queue.lock); return put_user(amount, (unsigned int __user *) argp); }