diff options
| author | Ka-Cheong Poon <ka-cheong.poon@oracle.com> | 2019-09-24 08:51:16 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-05 15:11:19 +0200 |
| commit | a9f6c8350c5db7b26302cbef34ec77894fab1a48 (patch) | |
| tree | e980c3c44d76c9a3297714642eb8bbfd0cb47e4a /net/rds | |
| parent | a4e16dca3940030a0ca83c1b79b0d0aa4db21c61 (diff) | |
| download | linux-stable-a9f6c8350c5db7b26302cbef34ec77894fab1a48.tar.gz linux-stable-a9f6c8350c5db7b26302cbef34ec77894fab1a48.tar.bz2 linux-stable-a9f6c8350c5db7b26302cbef34ec77894fab1a48.zip | |
net/rds: Check laddr_check before calling it
[ Upstream commit 05733434ee9ae6548723a808647248583e347cca ]
In rds_bind(), laddr_check is called without checking if it is NULL or
not. And rs_transport should be reset if rds_add_bound() fails.
Fixes: c5c1a030a7db ("net/rds: An rds_sock is added too early to the hash table")
Reported-by: syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com
Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/rds')
| -rw-r--r-- | net/rds/bind.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/rds/bind.c b/net/rds/bind.c index 05464fd7c17a..93e336535d3b 100644 --- a/net/rds/bind.c +++ b/net/rds/bind.c @@ -244,7 +244,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) */ if (rs->rs_transport) { trans = rs->rs_transport; - if (trans->laddr_check(sock_net(sock->sk), + if (!trans->laddr_check || + trans->laddr_check(sock_net(sock->sk), binding_addr, scope_id) != 0) { ret = -ENOPROTOOPT; goto out; @@ -263,6 +264,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) sock_set_flag(sk, SOCK_RCU_FREE); ret = rds_add_bound(rs, binding_addr, &port, scope_id); + if (ret) + rs->rs_transport = NULL; out: release_sock(sk); |