From b58662a5f7f4677debd5e28d10145cf5decd516b Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 5 Sep 2019 13:20:41 -0700 Subject: tcp: ulp: fix possible crash in tcp_diag_get_aux_size() tcp_diag_get_aux_size() can be called with sockets in any state. icsk_ulp_ops is only present for full sockets. For SYN_RECV or TIME_WAIT ones we would access garbage. Fixes: 61723b393292 ("tcp: ulp: add functions to dump ulp-specific information") Signed-off-by: Eric Dumazet Reported-by: Luke Hsiao Reported-by: Neal Cardwell Cc: Davide Caratti Acked-by: Davide Caratti Signed-off-by: David S. Miller --- net/ipv4/tcp_diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c index babc156deabb..81a8221d650a 100644 --- a/net/ipv4/tcp_diag.c +++ b/net/ipv4/tcp_diag.c @@ -163,7 +163,7 @@ static size_t tcp_diag_get_aux_size(struct sock *sk, bool net_admin) } #endif - if (net_admin) { + if (net_admin && sk_fullsock(sk)) { const struct tcp_ulp_ops *ulp_ops; ulp_ops = icsk->icsk_ulp_ops; -- cgit