From 752848f86e67d0634c413e097363172f4f18d98b Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Thu, 12 Nov 2015 12:15:29 +0100 Subject: kernel: net: rds: CVE-2015-7990 Fixes Race condition when sending message on unbound socket causing NULL pointer dereference. CVE-2015-7990 is a complete fix for CVE-2015-6937. References: https://lkml.org/lkml/2015/10/16/530 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7990 Signed-off-by: Sona Sarmadi Signed-off-by: Tudor Florea --- ...2015-7990-a-complete-fix-of-CVE-2015-6937.patch | 80 ++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 recipes-kernel/linux/linux-hierofalcon/RDS-CVE-2015-7990-a-complete-fix-of-CVE-2015-6937.patch (limited to 'recipes-kernel/linux/linux-hierofalcon') diff --git a/recipes-kernel/linux/linux-hierofalcon/RDS-CVE-2015-7990-a-complete-fix-of-CVE-2015-6937.patch b/recipes-kernel/linux/linux-hierofalcon/RDS-CVE-2015-7990-a-complete-fix-of-CVE-2015-6937.patch new file mode 100644 index 0000000..c73d743 --- /dev/null +++ b/recipes-kernel/linux/linux-hierofalcon/RDS-CVE-2015-7990-a-complete-fix-of-CVE-2015-6937.patch @@ -0,0 +1,80 @@ +From Quentin Casasnovas <> +Subject [PATCH] RDS: fix race condition when sending a message on unbound +socket. +Date Fri, 16 Oct 2015 17:11:42 +0200 + + +Sasha's found a NULL pointer dereference in the RDS connection code when +sending a message to an apparently unbound socket. The problem is caused +by the code checking if the socket is bound in rds_sendmsg(), which checks +the rs_bound_addr field without taking a lock on the socket. This opens a +race where rs_bound_addr is temporarily set but where the transport is not +in rds_bind(), leading to a NULL pointer dereference when trying to +dereference 'trans' in __rds_conn_create(). + +Vegard wrote a reproducer for this issue, so kindly ask him to share if +you're interested. + +I cannot reproduce the NULL pointer dereference using Vegard's reproducer +with this patch, whereas I could without. + +Complete earlier incomplete fix to CVE-2015-6937: + + 74e98eb08588 ("RDS: verify the underlying transport exists before creating a +connection") + +Fix for CVE-2015-7990, [from https://lkml.org/lkml/2015/10/16/530] + +Upstream-Status: Submitted + +Signed-off-by: Quentin Casasnovas +Reviewed-by: Vegard Nossum +Reviewed-by: Sasha Levin +Cc: Vegard Nossum +Cc: Sasha Levin +Cc: Chien Yen +Cc: Santosh Shilimkar +Cc: David S. Miller +Cc: stable@vger.kernel.org +--- + net/rds/connection.c | 6 ------ + net/rds/send.c | 4 +++- + 2 files changed, 3 insertions(+), 7 deletions(-) +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 49adeef..9b2de5e 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -190,12 +190,6 @@ new_conn: + } + } + +- if (trans == NULL) { +- kmem_cache_free(rds_conn_slab, conn); +- conn = ERR_PTR(-ENODEV); +- goto out; +- } +- + conn->c_trans = trans; + + ret = trans->conn_alloc(conn, gfp); +diff --git a/net/rds/send.c b/net/rds/send.c +index 4df61a5..859de6f 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -1009,11 +1009,13 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) + release_sock(sk); + } + +- /* racing with another thread binding seems ok here */ ++ lock_sock(sk); + if (daddr == 0 || rs->rs_bound_addr == 0) { ++ release_sock(sk); + ret = -ENOTCONN; /* XXX not a great errno */ + goto out; + } ++ release_sock(sk); + + if (payload_len > rds_sk_sndbuf(rs)) { + ret = -EMSGSIZE; +-- +2.4.9 -- cgit v1.2.3-54-g00ecf