mirror of https://github.com/torvalds/linux.git
8c7188b234
Sasha's found a NULL pointer dereference in the RDS connection code when
sending a message to an apparently unbound socket. The problem is caused
by the code checking if the socket is bound in rds_sendmsg(), which checks
the rs_bound_addr field without taking a lock on the socket. This opens a
race where rs_bound_addr is temporarily set but where the transport is not
in rds_bind(), leading to a NULL pointer dereference when trying to
dereference 'trans' in __rds_conn_create().
Vegard wrote a reproducer for this issue, so kindly ask him to share if
you're interested.
I cannot reproduce the NULL pointer dereference using Vegard's reproducer
with this patch, whereas I could without.
Complete earlier incomplete fix to CVE-2015-6937:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| af_rds.c | ||
| bind.c | ||
| cong.c | ||
| connection.c | ||
| ib.c | ||
| ib.h | ||
| ib_cm.c | ||
| ib_rdma.c | ||
| ib_recv.c | ||
| ib_ring.c | ||
| ib_send.c | ||
| ib_stats.c | ||
| ib_sysctl.c | ||
| info.c | ||
| info.h | ||
| iw.c | ||
| iw.h | ||
| iw_cm.c | ||
| iw_rdma.c | ||
| iw_recv.c | ||
| iw_ring.c | ||
| iw_send.c | ||
| iw_stats.c | ||
| iw_sysctl.c | ||
| loop.c | ||
| loop.h | ||
| message.c | ||
| page.c | ||
| rdma.c | ||
| rdma_transport.c | ||
| rdma_transport.h | ||
| rds.h | ||
| recv.c | ||
| send.c | ||
| stats.c | ||
| sysctl.c | ||
| tcp.c | ||
| tcp.h | ||
| tcp_connect.c | ||
| tcp_listen.c | ||
| tcp_recv.c | ||
| tcp_send.c | ||
| tcp_stats.c | ||
| threads.c | ||
| transport.c | ||