tree 6b45149fcc6fb391d5dc8bfe2e75b732dc5b2ee1
parent baaf0c65bc8ea9c7a404b09bc8cc3b8a1e4f18df
author Eric Dumazet <edumazet@google.com> 1480343209 -0800
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1481393244 +0100

net/dccp: fix use-after-free in dccp_invalid_packet

[ Upstream commit 648f0c28df282636c0c8a7a19ca3ce5fc80a39c3 ]

pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
in dccp_invalid_packet() or risk use after free.

Bug found by Andrey Konovalov using syzkaller.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>