Dave Watson d97af30f61 tcp: fix null ptr deref in getsockopt(..., TCP_ULP, ...) ...

If icsk_ulp_ops is unset, it dereferences a null ptr.
Add a null ptr check.

BUG: KASAN: null-ptr-deref in copy_to_user include/linux/uaccess.h:168 [inline]
BUG: KASAN: null-ptr-deref in do_tcp_getsockopt.isra.33+0x24f/0x1e30 net/ipv4/tcp.c:3057
Read of size 4 at addr 0000000000000020 by task syz-executor1/15452

Signed-off-by: Dave Watson <davejwatson@fb.com>
Reported-by: "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-06-27 15:39:11 -04:00

..

6lowpan

6lowpan: Don't set IFF_NO_QUEUE

2017-04-12 22:02:40 +02:00

9p

xen: fixes for 4.12 rc2

2017-05-19 15:06:48 -07:00

802

net: introduce __skb_put_[zero, data, u8]

2017-06-20 13:30:14 -04:00

8021q

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

appletalk

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

atm

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

ax25

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

batman-adv

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

bluetooth

net: introduce __skb_put_[zero, data, u8]

2017-06-20 13:30:14 -04:00

bpf

bpf: Align packet data properly in program testing framework.

2017-05-02 11:46:28 -04:00

bridge

net: add netlink_ext_ack argument to rtnl_link_ops.slave_changelink

2017-06-26 23:13:22 -04:00

caif

net: add netlink_ext_ack argument to rtnl_link_ops.changelink

2017-06-26 23:13:22 -04:00

can

networking: introduce and use skb_put_data()

2017-06-16 11:48:37 -04:00

ceph

libceph: cleanup old messages according to reconnect seq

2017-05-24 18:10:51 +02:00

core

net: add netlink_ext_ack argument to rtnl_link_ops.slave_validate

2017-06-26 23:13:22 -04:00

dcb

dcb: enforce minimum length on IEEE_APPS attribute

2017-05-21 13:42:33 -04:00

dccp

dccp: call inet_add_protocol after register_pernet_subsys in dccp_v6_init

2017-06-20 15:31:43 -04:00

decnet

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-06-21 17:35:22 -04:00

dns_resolver

Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-03-03 10:16:38 -08:00

dsa

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

ethernet

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

hsr

net: add netlink_ext_ack argument to rtnl_link_ops.newlink

2017-06-26 23:13:21 -04:00

ieee802154

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ife

net: Introduce ife encapsulation module

2017-02-03 15:16:45 -05:00

ipv4

tcp: fix null ptr deref in getsockopt(..., TCP_ULP, ...)

2017-06-27 15:39:11 -04:00

ipv6

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ipx

ipx: call ipxitf_put() in ioctl error path

2017-05-02 15:34:53 -04:00

irda

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

iucv

af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers

2017-06-25 11:42:58 -04:00

kcm

net: socket: mark socket protocol handler structs as const

2017-05-16 11:54:07 -04:00

key

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-06-23 14:17:31 -04:00

l2tp

l2tp: cast l2tp traffic counter to unsigned

2017-06-10 16:14:27 -04:00

l3mdev

…

lapb

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

llc

net: llc: add lock_sock in llc_ui_bind to avoid a race condition

2017-05-26 14:20:29 -04:00

mac80211

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

mac802154

net: Fix inconsistent teardown and release of private netdev state.

2017-06-07 15:53:24 -04:00

mpls

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-06-06 22:20:08 -04:00

ncsi

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

netfilter

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

netlabel

netlink: pass extended ACK struct to parsing functions

2017-04-13 13:58:22 -04:00

netlink

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

netrom

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

nfc

networking: add and use skb_put_u8()

2017-06-16 11:48:40 -04:00

openvswitch

net: store port/representator id in metadata_dst

2017-06-25 11:42:01 -04:00

packet

net/packet: remove unneeded declaraion of tpacket_snd().

2017-06-10 16:15:25 -04:00

phonet

net: Fix inconsistent teardown and release of private netdev state.

2017-06-07 15:53:24 -04:00

psample

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

qrtr

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

rds

rds: tcp: set linger to 1 when unloading a rds-tcp

2017-06-22 11:34:04 -04:00

rfkill

net: rfkill: gpio: Switch to devm_acpi_dev_add_driver_gpios()

2017-06-13 11:07:51 +02:00

rose

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

rxrpc

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-06-21 17:35:22 -04:00

sched

bpf: expose prog id for cls_bpf and act_bpf

2017-06-21 15:14:23 -04:00

sctp

sctp: adjust ssthresh when transport is idle

2017-06-25 14:43:53 -04:00

smc

net/smc: Add warning about remote memory exposure

2017-05-16 14:49:43 -04:00

strparser

strparser: destroy workqueue on module exit

2017-03-03 20:43:26 -08:00

sunrpc

SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()

2017-05-31 12:26:44 -04:00

switchdev

net: switchdev: Change notifier chain to be atomic

2017-06-08 14:16:24 -04:00

tipc

net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse

2017-06-10 18:20:38 -04:00

tls

tls: return -EFAULT if copy_to_user() fails

2017-06-23 14:19:27 -04:00

unix

af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers

2017-06-09 10:10:24 -04:00

vmw_vsock

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

wimax

…

wireless

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-06-21 17:35:22 -04:00

x25

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

xfrm

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-06-23 14:17:31 -04:00

compat.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-02-22 10:15:09 -08:00

Kconfig

tls: kernel TLS support

2017-06-15 12:12:40 -04:00

Makefile

tls: kernel TLS support

2017-06-15 12:12:40 -04:00

socket.c

net: socket: fix a typo in sockfd_lookup().

2017-05-22 12:14:04 -04:00

sysctl_net.c

sysctl: Remove dead register_sysctl_root

2017-04-16 23:42:49 -05:00