Commit fc3d2964 authored Sep 24, 2019 by Ka-Cheong Poon Committed by Greg Kroah-Hartman Oct 01, 2019

net/rds: Check laddr_check before calling it



[ Upstream commit 05733434ee9ae6548723a808647248583e347cca ]

In rds_bind(), laddr_check is called without checking if it is NULL or
not.  And rs_transport should be reset if rds_add_bound() fails.

Fixes: c5c1a030a7db ("net/rds: An rds_sock is added too early to the hash table")
Reported-by:  <syzbot+fae39afd2101a17ec624@syzkaller.appspotmail.com>
Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 3de749d6

net/rds/bind.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -244,7 +244,8 @@ int rds_bind(struct socket sock, struct sockaddr uaddr, int addr_len)
		*/
		if (rs->rs_transport) {
		trans = rs->rs_transport;
		if (trans->laddr_check(sock_net(sock->sk),
		if (!trans->laddr_check \|\|
		trans->laddr_check(sock_net(sock->sk),
		binding_addr, scope_id) != 0) {
		ret = -ENOPROTOOPT;
		goto out;
		@@ -263,6 +264,8 @@ int rds_bind(struct socket sock, struct sockaddr uaddr, int addr_len)

		sock_set_flag(sk, SOCK_RCU_FREE);
		ret = rds_add_bound(rs, binding_addr, &port, scope_id);
		if (ret)
		rs->rs_transport = NULL;

		out:
		release_sock(sk);