Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 05733434 authored by Ka-Cheong Poon's avatar Ka-Cheong Poon Committed by David S. Miller
Browse files

net/rds: Check laddr_check before calling it 



In rds_bind(), laddr_check is called without checking if it is NULL or
not.  And rs_transport should be reset if rds_add_bound() fails.

Fixes: c5c1a030 ("net/rds: An rds_sock is added too early to the hash table")
Reported-by: default avatar <syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com>
Signed-off-by: default avatarKa-Cheong Poon <ka-cheong.poon@oracle.com>
Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4e1e83be

net/rds/bind.c

+4 −1
Original line number Diff line number Diff line
@@ -244,7 +244,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) 
	 */

	if (rs->rs_transport) {

		trans = rs->rs_transport;

		if (trans->laddr_check(sock_net(sock->sk),

		if (!trans->laddr_check ||

		    trans->laddr_check(sock_net(sock->sk),

				       binding_addr, scope_id) != 0) {

			ret = -ENOPROTOOPT;

			goto out;
@@ -263,6 +264,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) 


	sock_set_flag(sk, SOCK_RCU_FREE);

	ret = rds_add_bound(rs, binding_addr, &port, scope_id);

	if (ret)

		rs->rs_transport = NULL;



out:

	release_sock(sk);