diff options
| author | Andy Whitcroft <apw@canonical.com> | 2012-07-26 11:25:52 +0100 |
|---|---|---|
| committer | John Rigby <john.rigby@linaro.org> | 2012-08-15 23:46:12 -0600 |
| commit | cc749965473b91af301c2c5f3d85c737746677bf (patch) | |
| tree | c84f93a7895e6e0bd0946a60c0fab61322a858c6 | |
| parent | 77cc0d917e77928d0b9e421fe5274d291840d03a (diff) | |
UBUNTU: SAUCE: rds_ib_send() -- prevent local pings triggering BUG_ON()
Pining localhost on an infiniband connection can trigger a BUG_ON()
and cause a denial of service.
Fix identified by comparison of the RHEL source rpms.
CVE-2012-2372
BugLink: http://bugs.launchpad.net/bugs/1016299
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
| -rw-r--r-- | net/rds/ib_send.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c index e5909498117..7920c850775 100644 --- a/net/rds/ib_send.c +++ b/net/rds/ib_send.c @@ -544,7 +544,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm, int flow_controlled = 0; int nr_sig = 0; - BUG_ON(off % RDS_FRAG_SIZE); + BUG_ON(!conn->c_loopback && off % RDS_FRAG_SIZE); BUG_ON(hdr_off != 0 && hdr_off != sizeof(struct rds_header)); /* Do not send cong updates to IB loopback */ |