| Message ID | 1568734158-18021-1-git-send-email-ka-cheong.poon@oracle.com |
|---|---|
| State | Changes Requested |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] net/rds: Check laddr_check before calling it | expand |
On 9/17/19 8:29 AM, Ka-Cheong Poon wrote: > In rds_bind(), laddr_check is called without checking if it is NULL or > not. And rs_transport should be reset if rds_add_bound() fails. > > Reported-by: syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com > Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com> > --- Thanks Ka-Cheong for getting this out quickly on list. Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
On Tue, 17 Sep 2019 08:29:18 -0700, Ka-Cheong Poon wrote: > In rds_bind(), laddr_check is called without checking if it is NULL or > not. And rs_transport should be reset if rds_add_bound() fails. > > Reported-by: syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com > Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com> Looks good, but could you please provide a fixes tag?
From: Ka-Cheong Poon <ka-cheong.poon@oracle.com> Date: Tue, 17 Sep 2019 08:29:18 -0700 > In rds_bind(), laddr_check is called without checking if it is NULL or > not. And rs_transport should be reset if rds_add_bound() fails. > > Reported-by: syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com > Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com> Please resubmit with an appropriate Fixes: tag. Thank you.
On 9/21/19 9:09 AM, Jakub Kicinski wrote: > On Tue, 17 Sep 2019 08:29:18 -0700, Ka-Cheong Poon wrote: >> In rds_bind(), laddr_check is called without checking if it is NULL or >> not. And rs_transport should be reset if rds_add_bound() fails. >> >> Reported-by: syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com >> Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com> > > Looks good, but could you please provide a fixes tag? Done. Thanks.
diff --git a/net/rds/bind.c b/net/rds/bind.c index 20c156a..5b5fb4c 100644 --- a/net/rds/bind.c +++ b/net/rds/bind.c @@ -244,7 +244,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) */ if (rs->rs_transport) { trans = rs->rs_transport; - if (trans->laddr_check(sock_net(sock->sk), + if (!trans->laddr_check || + trans->laddr_check(sock_net(sock->sk), binding_addr, scope_id) != 0) { ret = -ENOPROTOOPT; goto out; @@ -263,6 +264,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) sock_set_flag(sk, SOCK_RCU_FREE); ret = rds_add_bound(rs, binding_addr, &port, scope_id); + if (ret) + rs->rs_transport = NULL; out: release_sock(sk);
In rds_bind(), laddr_check is called without checking if it is NULL or not. And rs_transport should be reset if rds_add_bound() fails. Reported-by: syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com> --- net/rds/bind.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)