From: Jason Xing kernelxing@tencent.com

stable inclusion from stable-v4.19.310 commit 500936692ccca8617a955652d1929f079b17a201 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q95M CVE: CVE-2024-27427

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

[ Upstream commit 60a7a152abd494ed4f69098cf0f322e6bb140612 ]

We need to protect the reader reading the sysctl value because the value can be changed concurrently.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing kernelxing@tencent.com Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Hui Tang tanghui20@huawei.com --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 8f18fea17cfc..82daed1296f5 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -456,7 +456,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr_init_timers(sk);

nr->t1 = - msecs_to_jiffies(sysctl_netrom_transport_timeout); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_timeout)); nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 =