summaryrefslogtreecommitdiffstats
path: root/rds-prevent-dereference-of-a-NULL-device-in-rds_iw_laddr_check.patch
diff options
context:
space:
mode:
authorJosh Boyer <jwboyer@fedoraproject.org>2014-04-01 16:05:48 -0400
committerJosh Boyer <jwboyer@redhat.com>2014-04-01 20:08:48 -0400
commit9969f4229cb12c59b85a05173822dbd70f5e931e (patch)
tree1d9c049fcc2f35c6ca86810be97be54d3d2445f9 /rds-prevent-dereference-of-a-NULL-device-in-rds_iw_laddr_check.patch
parentfbff9edd561dc72e99d83e4cc60bf3f0831ec492 (diff)
downloadkernel-9969f4229cb12c59b85a05173822dbd70f5e931e.tar.gz
kernel-9969f4229cb12c59b85a05173822dbd70f5e931e.tar.xz
kernel-9969f4229cb12c59b85a05173822dbd70f5e931e.zip
CVE-2014-2678 net: rds: deref of NULL dev in rds_iw_laddr_check (rhbz 1083274 1083280)
Diffstat (limited to 'rds-prevent-dereference-of-a-NULL-device-in-rds_iw_laddr_check.patch')
-rw-r--r--rds-prevent-dereference-of-a-NULL-device-in-rds_iw_laddr_check.patch31
1 files changed, 31 insertions, 0 deletions
diff --git a/rds-prevent-dereference-of-a-NULL-device-in-rds_iw_laddr_check.patch b/rds-prevent-dereference-of-a-NULL-device-in-rds_iw_laddr_check.patch
new file mode 100644
index 000000000..2caf0666e
--- /dev/null
+++ b/rds-prevent-dereference-of-a-NULL-device-in-rds_iw_laddr_check.patch
@@ -0,0 +1,31 @@
+Bugzilla: 1083280
+Upstream-status: Queued for 3.15
+
+From bf39b4247b8799935ea91d90db250ab608a58e50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Sat, 29 Mar 2014 20:39:35 -0400
+Subject: rds: prevent dereference of a NULL device in rds_iw_laddr_check
+
+Binding might result in a NULL device which is later dereferenced
+without checking.
+
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+diff --git a/net/rds/iw.c b/net/rds/iw.c
+index 7826d46..5899356 100644
+--- a/net/rds/iw.c
++++ b/net/rds/iw.c
+@@ -239,7 +239,8 @@ static int rds_iw_laddr_check(__be32 addr)
+ ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin);
+ /* due to this, we will claim to support IB devices unless we
+ check node_type. */
+- if (ret || cm_id->device->node_type != RDMA_NODE_RNIC)
++ if (ret || !cm_id->device ||
++ cm_id->device->node_type != RDMA_NODE_RNIC)
+ ret = -EADDRNOTAVAIL;
+
+ rdsdebug("addr %pI4 ret %d node type %d\n",
+--
+cgit v0.10.1
+