| commit | 648f0c28df282636c0c8a7a19ca3ce5fc80a39c3 | [log] [tgz] |
|---|---|---|
| author | Eric Dumazet <edumazet@google.com> | Mon Nov 28 06:26:49 2016 -0800 |
| committer | David S. Miller <davem@davemloft.net> | Tue Nov 29 20:37:26 2016 -0500 |
| tree | 21a521e1c65060e4ef3060e122915134c29aa931 | |
| parent | ffac0e967f20b7637936dbaa21df08c55f672604 [diff] |
net/dccp: fix use-after-free in dccp_invalid_packet pskb_may_pull() can reallocate skb->head, we need to reload dh pointer in dccp_invalid_packet() or risk use after free. Bug found by Andrey Konovalov using syzkaller. Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>