Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755478AbbKCQ1k (ORCPT ); Tue, 3 Nov 2015 11:27:40 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:17239 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755381AbbKCQ1g (ORCPT ); Tue, 3 Nov 2015 11:27:36 -0500 Subject: Re: [PATCH] RDS: fix race condition when sending a message on unbound socket. To: Quentin Casasnovas References: <1445008302-14169-1-git-send-email-quentin.casasnovas@oracle.com> <56213845.6020900@oracle.com> <20151103112545.GD921@chrystal.uk.oracle.com> Cc: lkml , Vegard Nossum , Sasha Levin , Chien Yen , "David S. Miller" From: santosh shilimkar Organization: Oracle Corporation Message-ID: <5638E072.2090104@oracle.com> Date: Tue, 3 Nov 2015 08:27:30 -0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <20151103112545.GD921@chrystal.uk.oracle.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1523 Lines: 35 On 11/3/2015 3:25 AM, Quentin Casasnovas wrote: > On Fri, Oct 16, 2015 at 10:47:49AM -0700, santosh shilimkar wrote: >> On 10/16/2015 8:11 AM, Quentin Casasnovas wrote: >>> Sasha's found a NULL pointer dereference in the RDS connection code when >>> sending a message to an apparently unbound socket. The problem is caused >>> by the code checking if the socket is bound in rds_sendmsg(), which checks >>> the rs_bound_addr field without taking a lock on the socket. This opens a >>> race where rs_bound_addr is temporarily set but where the transport is not >>> in rds_bind(), leading to a NULL pointer dereference when trying to >>> dereference 'trans' in __rds_conn_create(). >>> >>> Vegard wrote a reproducer for this issue, so kindly ask him to share if >>> you're interested. >>> >>> I cannot reproduce the NULL pointer dereference using Vegard's reproducer >>> with this patch, whereas I could without. >>> >>> Complete earlier incomplete fix to CVE-2015-6937: >>> >>> 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") >>> > > For reference, this has been assigned CVE-2015-7990 on the oss-sec thread: > > http://seclists.org/oss-sec/2015/q4/179 > New CVE number than the older one. Thanks for the note. Regards, Santosh -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/