diff options
| author | Andy Whitcroft <apw@canonical.com> | 2012-07-26 11:25:52 +0100 |
|---|---|---|
| committer | John Rigby <john.rigby@linaro.org> | 2012-11-14 18:19:34 -0700 |
| commit | 2f98f864ce5e2cfafe26a6fbd3d0aba22157257b (patch) | |
| tree | 0592631e0a586274f08dfa7548172914da85d558 | |
| parent | b6fbc6a4a039586ff92519712f9f4d579e640e37 (diff) | |
UBUNTU: SAUCE: rds_ib_send() -- prevent local pings triggering BUG_ON()
Pining localhost on an infiniband connection can trigger a BUG_ON()
and cause a denial of service.
Fix identified by comparison of the RHEL source rpms.
CVE-2012-2372
BugLink: http://bugs.launchpad.net/bugs/1016299
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
| -rw-r--r-- | net/rds/ib_send.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c index e5909498117..7920c850775 100644 --- a/net/rds/ib_send.c +++ b/net/rds/ib_send.c @@ -544,7 +544,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm, int flow_controlled = 0; int nr_sig = 0; - BUG_ON(off % RDS_FRAG_SIZE); + BUG_ON(!conn->c_loopback && off % RDS_FRAG_SIZE); BUG_ON(hdr_off != 0 && hdr_off != sizeof(struct rds_header)); /* Do not send cong updates to IB loopback */ |