Alexey Kodanev de31c39167 dccp: check sk for closed state in dccp_sendmsg() ... [ Upstream commit 67f93df79aeefc3add4e4b31a752600f834236e2 ] dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL, therefore if DCCP socket is disconnected and dccp_sendmsg() is called after it, it will cause a NULL pointer dereference in dccp_write_xmit(). This crash and the reproducer was reported by syzbot. Looks like it is reproduced if commit 69c64866ce07 ("dccp: CVE-2017-8824: use-after-free in DCCP code") is applied. Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-03-31 18:12:33 +02:00
..
ccids	dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state	2018-01-31 12:06:12 +01:00
ackvec.c
ackvec.h
ccid.c
ccid.h
dccp.h
diag.c
feat.c	dccp: fix a memleak for dccp_feat_init err process	2017-08-11 09:08:54 -07:00
feat.h
input.c
ipv4.c	tcp/dccp: fix other lockdep splats accessing ireq_opt	2017-11-18 11:11:07 +01:00
ipv6.c	dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly	2017-08-11 09:08:54 -07:00
ipv6.h
Kconfig
Makefile
minisocks.c
options.c
output.c
probe.c
proto.c	dccp: check sk for closed state in dccp_sendmsg()	2018-03-31 18:12:33 +02:00
qpolicy.c
sysctl.c
timer.c