Quentin Casasnovas 4ee85dafc1 RDS: fix race condition when sending a message on unbound socket ... commit 8c7188b23474cca017b3ef354c4a58456f68303a upstream. Sasha's found a NULL pointer dereference in the RDS connection code when sending a message to an apparently unbound socket. The problem is caused by the code checking if the socket is bound in rds_sendmsg(), which checks the rs_bound_addr field without taking a lock on the socket. This opens a race where rs_bound_addr is temporarily set but where the transport is not in rds_bind(), leading to a NULL pointer dereference when trying to dereference 'trans' in __rds_conn_create(). Vegard wrote a reproducer for this issue, so kindly ask him to share if you're interested. I cannot reproduce the NULL pointer dereference using Vegard's reproducer with this patch, whereas I could without. Complete earlier incomplete fix to CVE-2015-6937: 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") Cc: David S. Miller <davem@davemloft.net> Reviewed-by: Vegard Nossum <vegard.nossum@oracle.com> Reviewed-by: Sasha Levin <sasha.levin@oracle.com> Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Zefan Li <lizefan@huawei.com>		2016-03-21 09:17:54 +08:00
..
af_rds.c
bind.c
cong.c
connection.c	RDS: fix race condition when sending a message on unbound socket	2016-03-21 09:17:54 +08:00
ib.c	rds: prevent dereference of a NULL device	2014-01-15 15:27:11 -08:00
ib.h
ib_cm.c
ib_rdma.c	rds: rds_ib_device.refcount overflow	2016-03-21 09:17:44 +08:00
ib_recv.c
ib_ring.c
ib_send.c	rds: prevent BUG_ON triggered on congestion update to loopback	2014-01-15 15:27:10 -08:00
ib_stats.c
ib_sysctl.c
info.c	rds: fix an integer overflow test in rds_info_getsockopt()	2016-03-21 09:17:50 +08:00
info.h
iw.c	rds: prevent dereference of a NULL device in rds_iw_laddr_check	2014-04-26 17:13:18 -07:00
iw.h
iw_cm.c
iw_rdma.c
iw_recv.c
iw_ring.c
iw_send.c
iw_stats.c
iw_sysctl.c
Kconfig
loop.c
loop.h
Makefile
message.c	rds: limit the size allocated by rds_message_alloc()	2013-03-20 13:05:01 -07:00
page.c
rdma.c
rdma_transport.c
rdma_transport.h
rds.h
recv.c	net: rework recvmsg handler msg_name and msg_namelen logic	2013-12-08 07:29:41 -08:00
send.c	RDS: fix race condition when sending a message on unbound socket	2016-03-21 09:17:54 +08:00
stats.c
sysctl.c
tcp.c
tcp.h
tcp_connect.c
tcp_listen.c
tcp_recv.c
tcp_send.c
tcp_stats.c
threads.c
transport.c