Description
In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.
Product status
f6efc675c9dd8d93f826b79ae7e33e03301db609 (git) before 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7
f6efc675c9dd8d93f826b79ae7e33e03301db609 (git) before 0f1630be6fcca3f0c63e4b242ad202e5cde28a40
f6efc675c9dd8d93f826b79ae7e33e03301db609 (git) before ca18d751bcc9faf5b7e82e9fae1223d103928181
f6efc675c9dd8d93f826b79ae7e33e03301db609 (git) before 94731cc551e29511d85aa8dec61a6c071b1f2430
f6efc675c9dd8d93f826b79ae7e33e03301db609 (git) before f97f6475fdcb3c28ff3c55cc4b7bde632119ec08
f6efc675c9dd8d93f826b79ae7e33e03301db609 (git) before 0417adf367a0af11adf7ace849af4638cfb573f7
5.13
Any version before 5.13
5.15.190 (semver)
6.1.149 (semver)
6.6.103 (semver)
6.12.44 (semver)
6.16.4 (semver)
6.17 (original_commit_for_fix)
References
git.kernel.org/...c/9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7
git.kernel.org/...c/0f1630be6fcca3f0c63e4b242ad202e5cde28a40
git.kernel.org/...c/ca18d751bcc9faf5b7e82e9fae1223d103928181
git.kernel.org/...c/94731cc551e29511d85aa8dec61a6c071b1f2430
git.kernel.org/...c/f97f6475fdcb3c28ff3c55cc4b7bde632119ec08
git.kernel.org/...c/0417adf367a0af11adf7ace849af4638cfb573f7
