• Xin Long's avatar
    sctp: return next obj by passing pos + 1 into sctp_transport_get_idx · 988c7322
    Xin Long authored
    In sctp_for_each_transport, pos is used to save how many objs it has
    dumped. Now it gets the last obj by sctp_transport_get_idx, then gets
    the next obj by sctp_transport_get_next.
    
    The issue is that in the meanwhile if some objs in transport hashtable
    are removed and the objs nums are less than pos, sctp_transport_get_idx
    would return NULL and hti.walker.tbl is NULL as well. At this moment
    it should stop hti, instead of continue getting the next obj. Or it
    would cause a NULL pointer dereference in sctp_transport_get_next.
    
    This patch is to pass pos + 1 into sctp_transport_get_idx to get the
    next obj directly, even if pos > objs nums, it would return NULL and
    stop hti.
    
    Fixes: 626d16f5 ("sctp: export some apis or variables for sctp_diag and reuse some for proc")
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    988c7322
socket.c 226 KB