Messages in this thread | | | Date | Tue, 29 Nov 2016 20:38:01 -0500 (EST) | Subject | Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet | From | David Miller <> |
| |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Mon, 28 Nov 2016 06:26:49 -0800
> From: Eric Dumazet <edumazet@google.com> > > pskb_may_pull() can reallocate skb->head, we need to reload dh pointer > in dccp_invalid_packet() or risk use after free. > > Bug found by Andrey Konovalov using syzkaller. > > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Andrey Konovalov <andreyknvl@google.com>
Applied and queued up for -stable, thanks Eric.
| |