rds: Second bind() can overwrite the first bind()

In rds_bind(), it does not check if a socket is already bound
or not.  Hence a second bind() will overwrite what is done in
the first bind().

Orabug: 27463500

Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>

diff --git a/net/rds/bind.c b/net/rds/bind.c
index 31d56d469276ca5f4f148219a12db7176a49be8c..a9e4578079d631747961c39891a840cd4a058479 100644 (file)
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2017 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -227,6 +227,12 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
        lock_sock(sk);
 
+       /* RDS socket does not allow re-binding. */
+       if (!ipv6_addr_any(&rs->rs_bound_addr)) {
+               ret = -EINVAL;
+               goto out;
+       }
+
        ret = rds_add_bound(rs, binding_addr, &port, scope_id);
        if (ret)
                goto out;