tree 21a521e1c65060e4ef3060e122915134c29aa931
parent ffac0e967f20b7637936dbaa21df08c55f672604
author Eric Dumazet <edumazet@google.com> 1480343209 -0800
committer David S. Miller <davem@davemloft.net> 1480469846 -0500

net/dccp: fix use-after-free in dccp_invalid_packet

pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
in dccp_invalid_packet() or risk use after free.

Bug found by Andrey Konovalov using syzkaller.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>