Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754959AbbKXSns (ORCPT ); Tue, 24 Nov 2015 13:43:48 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:26456 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754413AbbKXSnn (ORCPT ); Tue, 24 Nov 2015 13:43:43 -0500 Subject: Re: [PATCH] RDS: fix race condition when sending a message on unbound socket. To: Ben Hutchings , Quentin Casasnovas References: <1445008302-14169-1-git-send-email-quentin.casasnovas@oracle.com> <56213845.6020900@oracle.com> <20151103112545.GD921@chrystal.uk.oracle.com> <1448389547.27159.8.camel@decadent.org.uk> Cc: lkml , Vegard Nossum , Sasha Levin , Chien Yen , "David S. Miller" From: santosh shilimkar Organization: Oracle Corporation Message-ID: <5654AFD1.9000202@oracle.com> Date: Tue, 24 Nov 2015 10:43:29 -0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <1448389547.27159.8.camel@decadent.org.uk> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1822 Lines: 41 On 11/24/2015 10:25 AM, Ben Hutchings wrote: > On Tue, 2015-11-03 at 12:25 +0100, Quentin Casasnovas wrote: >> On Fri, Oct 16, 2015 at 10:47:49AM -0700, santosh shilimkar wrote: >>> On 10/16/2015 8:11 AM, Quentin Casasnovas wrote: >>>> Sasha's found a NULL pointer dereference in the RDS connection code when >>>> sending a message to an apparently unbound socket. The problem is caused >>>> by the code checking if the socket is bound in rds_sendmsg(), which checks >>>> the rs_bound_addr field without taking a lock on the socket. This opens a >>>> race where rs_bound_addr is temporarily set but where the transport is not >>>> in rds_bind(), leading to a NULL pointer dereference when trying to >>>> dereference 'trans' in __rds_conn_create(). >>>> >>>> Vegard wrote a reproducer for this issue, so kindly ask him to share if >>>> you're interested. >>>> >>>> I cannot reproduce the NULL pointer dereference using Vegard's reproducer >>>> with this patch, whereas I could without. >>>> >>>> Complete earlier incomplete fix to CVE-2015-6937: >>>> >>>> 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") >>>> >> >> For reference, this has been assigned CVE-2015-7990 on the oss-sec thread: >> >> http://seclists.org/oss-sec/2015/q4/179 > > But the patch doesn't seem to have gone anywhere. Santosh, can you > apply this in your tree and ask David to pull, or should Quentin re- > send it to netdev? > Indeed, its not picked up yet. I will send the refreshed patch for Dave to pull. Thanks for reporting Ben. Regards, Santosh -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/