From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754128AbbJPRr4 (ORCPT ); Fri, 16 Oct 2015 13:47:56 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:17151 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750756AbbJPRrz (ORCPT ); Fri, 16 Oct 2015 13:47:55 -0400 Subject: Re: [PATCH] RDS: fix race condition when sending a message on unbound socket. To: Quentin Casasnovas , lkml References: <1445008302-14169-1-git-send-email-quentin.casasnovas@oracle.com> Cc: Vegard Nossum , Sasha Levin , Chien Yen , "David S. Miller" From: santosh shilimkar Organization: Oracle Corporation Message-ID: <56213845.6020900@oracle.com> Date: Fri, 16 Oct 2015 10:47:49 -0700 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <1445008302-14169-1-git-send-email-quentin.casasnovas@oracle.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/16/2015 8:11 AM, Quentin Casasnovas wrote: > Sasha's found a NULL pointer dereference in the RDS connection code when > sending a message to an apparently unbound socket. The problem is caused > by the code checking if the socket is bound in rds_sendmsg(), which checks > the rs_bound_addr field without taking a lock on the socket. This opens a > race where rs_bound_addr is temporarily set but where the transport is not > in rds_bind(), leading to a NULL pointer dereference when trying to > dereference 'trans' in __rds_conn_create(). > > Vegard wrote a reproducer for this issue, so kindly ask him to share if > you're interested. > > I cannot reproduce the NULL pointer dereference using Vegard's reproducer > with this patch, whereas I could without. > > Complete earlier incomplete fix to CVE-2015-6937: > > 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") > > Signed-off-by: Quentin Casasnovas > Reviewed-by: Vegard Nossum > Reviewed-by: Sasha Levin > Cc: Vegard Nossum > Cc: Sasha Levin > Cc: Chien Yen > Cc: Santosh Shilimkar > Cc: David S. Miller > Cc: stable@vger.kernel.org > --- Looks right. Am glad that we got deference issue as well as the bind race fixed with it. Mail sent to Vegard for his test case which I would like to add to my tests. Thanks for the fix. FWIW, Acked-by: Santosh Shilimkar