Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751460AbbKCLZJ (ORCPT ); Tue, 3 Nov 2015 06:25:09 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:24686 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750817AbbKCLZH (ORCPT ); Tue, 3 Nov 2015 06:25:07 -0500 Date: Tue, 3 Nov 2015 12:25:45 +0100 From: Quentin Casasnovas To: santosh shilimkar Cc: Quentin Casasnovas , lkml , Vegard Nossum , Sasha Levin , Chien Yen , "David S. Miller" Subject: Re: [PATCH] RDS: fix race condition when sending a message on unbound socket. Message-ID: <20151103112545.GD921@chrystal.uk.oracle.com> References: <1445008302-14169-1-git-send-email-quentin.casasnovas@oracle.com> <56213845.6020900@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <56213845.6020900@oracle.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1397 Lines: 31 On Fri, Oct 16, 2015 at 10:47:49AM -0700, santosh shilimkar wrote: > On 10/16/2015 8:11 AM, Quentin Casasnovas wrote: > > Sasha's found a NULL pointer dereference in the RDS connection code when > > sending a message to an apparently unbound socket. The problem is caused > > by the code checking if the socket is bound in rds_sendmsg(), which checks > > the rs_bound_addr field without taking a lock on the socket. This opens a > > race where rs_bound_addr is temporarily set but where the transport is not > > in rds_bind(), leading to a NULL pointer dereference when trying to > > dereference 'trans' in __rds_conn_create(). > > > > Vegard wrote a reproducer for this issue, so kindly ask him to share if > > you're interested. > > > > I cannot reproduce the NULL pointer dereference using Vegard's reproducer > > with this patch, whereas I could without. > > > > Complete earlier incomplete fix to CVE-2015-6937: > > > > 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") > > For reference, this has been assigned CVE-2015-7990 on the oss-sec thread: http://seclists.org/oss-sec/2015/q4/179 Quentin -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/