Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet

From	David Miller <davem@davemloft.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet
Date	2016-11-30 02:40 +0100
Message-ID	<sJ22m-7Nz-9@gated-at.bofh.it> (permalink)
References	<sIual-2Cp-3@gated-at.bofh.it> <sIv6p-3fu-13@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Mon, 28 Nov 2016 06:26:49 -0800

> From: Eric Dumazet <edumazet@google.com>
> 
> pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
> in dccp_invalid_packet() or risk use after free.
> 
> Bug found by Andrey Konovalov using syzkaller.
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Andrey Konovalov <andreyknvl@google.com>

Applied and queued up for -stable, thanks Eric.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

net/dccp: use-after-free in dccp_invalid_packet Andrey Konovalov <andreyknvl@google.com> - 2016-11-28 14:30 +0100
  [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 15:30 +0100
    Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 15:50 +0100
      Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-11-28 16:10 +0100
        Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 16:30 +0100
          Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-11-28 16:40 +0100
    Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-11-28 15:50 +0100
    Re: [PATCH net] net/dccp: fix use-after-free in dccp_invalid_packet David Miller <davem@davemloft.net> - 2016-11-30 02:40 +0100

csiph-web