From: Ka-Cheong Poon Date: Mon, 18 Dec 2017 15:09:55 +0000 (-0800) Subject: rds: Un-connected socket sendmsg() with a NULL destination does not fail X-Git-Tag: v4.1.12-124.31.3~1226 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=032e4d4b1663621aceed4859b7242808a27ff220;p=users%2Fjedix%2Flinux-maple.git rds: Un-connected socket sendmsg() with a NULL destination does not fail If the destnation address used in sendto()/sendmsg() is NULL, the send call does not fail because the check done in rds_sendmsg() is not correct. Orabug: 27463507 Signed-off-by: Ka-Cheong Poon Reviewed-by: Darren Kenny --- diff --git a/net/rds/send.c b/net/rds/send.c index c43b21b83207..73a1b8b76b34 100644 --- a/net/rds/send.c +++ b/net/rds/send.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2006, 2017 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved. * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -1287,12 +1287,10 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) } lock_sock(sk); - if (ipv6_addr_any(&rs->rs_bound_addr)) { - if (ipv6_addr_any(&daddr)) { - release_sock(sk); - ret = -ENOTCONN; - goto out; - } + if (ipv6_addr_any(&rs->rs_bound_addr) || ipv6_addr_any(&daddr)) { + release_sock(sk); + ret = -ENOTCONN; + goto out; } else if (namelen != 0) { /* Cannot send to an IPv4 address using an IPv6 source * address and cannot send to an IPv6 address using an