Alexey Kodanev 91d27e0c30 dccp: check sk for closed state in dccp_sendmsg() ...

[ Upstream commit 67f93df79a ]

dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,
therefore if DCCP socket is disconnected and dccp_sendmsg() is
called after it, it will cause a NULL pointer dereference in
dccp_write_xmit().

This crash and the reproducer was reported by syzbot. Looks like
it is reproduced if commit 69c64866ce ("dccp: CVE-2017-8824:
use-after-free in DCCP code") is applied.

Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-03-31 18:10:40 +02:00

..

ccids

dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state

2018-01-31 14:03:44 +01:00

ackvec.c

dccp: drop null test before destroy functions

2015-09-15 16:49:43 -07:00

ackvec.h

net: dccp: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

ccid.c

dccp: drop null test before destroy functions

2015-09-15 16:49:43 -07:00

ccid.h

net: dccp: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

dccp.h

net: snmp: kill STATS_BH macros

2016-04-27 22:48:25 -04:00

diag.c

sock_diag: specify info_size per inet protocol

2015-06-15 19:49:22 -07:00

feat.c

dccp: fix a memleak for dccp_feat_init err process

2017-07-27 00:01:05 -07:00

feat.h

net: dccp: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

input.c

dccp: make const array error_code static

2017-07-13 09:24:02 -07:00

ipv4.c

tcp/dccp: fix other lockdep splats accessing ireq_opt

2017-10-26 17:41:32 +09:00

ipv6.c

net: dccp: Add handling of IPV6_PKTOPTIONS to dccp_v6_do_rcv()

2017-08-31 11:43:47 -07:00

ipv6.h

inet: includes a sock_common in request_sock

2013-10-10 00:08:07 -04:00

Kconfig

net/dccp: remove depends on CONFIG_EXPERIMENTAL

2013-01-11 11:39:34 -08:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

minisocks.c

tcp/dccp: block bh before arming time_wait timer

2017-12-17 15:07:57 +01:00

options.c

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

output.c

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

2017-03-02 08:42:32 +01:00

probe.c

Use 64-bit timekeeping

2015-11-01 17:01:16 -05:00

proto.c

dccp: check sk for closed state in dccp_sendmsg()

2018-03-31 18:10:40 +02:00

qpolicy.c

dccp qpolicy: Parameter checking of cmsg qpolicy parameters

2010-12-07 13:47:12 +01:00

sysctl.c

dccp: make the request_retries minimum is 1

2014-05-14 15:34:16 -04:00

timer.c

net: rename NET_{ADD|INC}_STATS_BH()

2016-04-27 22:48:24 -04:00