diff options
| author | Eric Dumazet <edumazet@google.com> | 2016-11-28 06:26:49 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-12-10 19:07:24 +0100 |
| commit | 1a15519fdcdb0f908ad1a3785178f9e18a2ebedb (patch) | |
| tree | 6b45149fcc6fb391d5dc8bfe2e75b732dc5b2ee1 /tools/perf/scripts/python/syscall-counts.py | |
| parent | baaf0c65bc8ea9c7a404b09bc8cc3b8a1e4f18df (diff) | |
net/dccp: fix use-after-free in dccp_invalid_packet
[ Upstream commit 648f0c28df282636c0c8a7a19ca3ce5fc80a39c3 ]
pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
in dccp_invalid_packet() or risk use after free.
Bug found by Andrey Konovalov using syzkaller.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python/syscall-counts.py')
0 files changed, 0 insertions, 0 deletions