From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752352AbdLFUpK convert rfc822-to-8bit (ORCPT ); Wed, 6 Dec 2017 15:45:10 -0500 Received: from shards.monkeyblade.net ([184.105.139.130]:55058 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751598AbdLFUpF (ORCPT ); Wed, 6 Dec 2017 15:45:05 -0500 Date: Wed, 06 Dec 2017 15:45:03 -0500 (EST) Message-Id: <20171206.154503.335867422494464163.davem@davemloft.net> To: Haakon.Bugge@oracle.com Cc: santosh.shilimkar@oracle.com, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, rds-devel@oss.oracle.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH net] rds: Fix NULL pointer dereference in __rds_rdma_map From: David Miller In-Reply-To: <20171206161828.8368-1-Haakon.Bugge@oracle.com> References: <20171206161828.8368-1-Haakon.Bugge@oracle.com> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=iso-8859-1 Content-Transfer-Encoding: 8BIT X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Wed, 06 Dec 2017 12:45:05 -0800 (PST) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Håkon Bugge Date: Wed, 6 Dec 2017 17:18:28 +0100 > This is a fix for syzkaller719569, where memory registration was > attempted without any underlying transport being loaded. > > Analysis of the case reveals that it is the setsockopt() RDS_GET_MR > (2) and RDS_GET_MR_FOR_DEST (7) that are vulnerable. > > Here is an example stack trace when the bug is hit: ... > The fix is to check the existence of an underlying transport in > __rds_rdma_map(). > > Signed-off-by: Håkon Bugge > Reported-by: syzbot Applied and queued up for -stable, thanks.