diff options
| author | Eric Dumazet <[email protected]> | 2016-11-28 14:26:49 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2016-11-30 01:37:26 +0000 |
| commit | 648f0c28df282636c0c8a7a19ca3ce5fc80a39c3 (patch) | |
| tree | 21a521e1c65060e4ef3060e122915134c29aa931 /lib/debugobjects.c | |
| parent | net: macb: ensure ordering write to re-enable RX smoothly (diff) | |
| download | kernel-648f0c28df282636c0c8a7a19ca3ce5fc80a39c3.tar.gz kernel-648f0c28df282636c0c8a7a19ca3ce5fc80a39c3.zip | |
net/dccp: fix use-after-free in dccp_invalid_packet
pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
in dccp_invalid_packet() or risk use after free.
Bug found by Andrey Konovalov using syzkaller.
Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: Andrey Konovalov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'lib/debugobjects.c')
0 files changed, 0 insertions, 0 deletions