Commits
![Eric Dumazet](https://secure.gravatar.com/avatar/f8a365da9e0ecf47ef21b257b0c3bdbc.jpg?s=96&d=mm)
Eric Dumazet committed 648f0c28df2
net/dccp: fix use-after-free in dccp_invalid_packet pskb_may_pull() can reallocate skb->head, we need to reload dh pointer in dccp_invalid_packet() or risk use after free. Bug found by Andrey Konovalov using syzkaller. Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>