commit 6e615c8701cd34d3c19be6ada43500b73bca5ce6
author Eric Dumazet <edumazet@google.com> Mon Sep 24 07:00:11 2012 +0000
committer chrmhoffmann <chrmhoffmann@gmail.com> Sat Aug 12 11:22:21 2017 +0200
tree b38f5df13be5caf15c42e6958c3b24329ae057c2
parent d7a02eed090f601b3f302459500f1d36bb924a8d

net: guard tcp_set_keepalive() to tcp sockets

Its possible to use RAW sockets to get a crash in
tcp_set_keepalive() / sk_reset_timer()

Fix is to make sure socket is a SOCK_STREAM one.

Change-Id: Ieeb498a3e623cfcb54e1c865a3c0229e4acf1e87
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/core/sock.c

diff --git a/net/core/sock.c b/net/core/sock.c
index 4d86dea..3a7b4f7d 100755
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -632,7 +632,8 @@
 
 	case SO_KEEPALIVE:
 #ifdef CONFIG_INET
-		if (sk->sk_protocol == IPPROTO_TCP)
+		if (sk->sk_protocol == IPPROTO_TCP &&
+		    sk->sk_type == SOCK_STREAM)
 			tcp_set_keepalive(sk, valbool);
 #endif
 		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);