From: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Date: Mon, 18 Dec 2017 16:23:57 +0000 (-0800)
Subject: rds: Second bind() can overwrite the first bind()
X-Git-Tag: v4.1.12-124.31.3~1225
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=9df5fd9575a428505c1b0294355ac532cc511a98;p=users%2Fjedix%2Flinux-maple.git

rds: Second bind() can overwrite the first bind()

In rds_bind(), it does not check if a socket is already bound
or not.  Hence a second bind() will overwrite what is done in
the first bind().

Orabug: 27463500

Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
---

diff --git a/net/rds/bind.c b/net/rds/bind.c
index 31d56d469276..a9e4578079d6 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2017 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -227,6 +227,12 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
 	lock_sock(sk);
 
+	/* RDS socket does not allow re-binding. */
+	if (!ipv6_addr_any(&rs->rs_bound_addr)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	ret = rds_add_bound(rs, binding_addr, &port, scope_id);
 	if (ret)
 		goto out;