Alexey Kodanev 67f93df79a dccp: check sk for closed state in dccp_sendmsg() ... dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL, therefore if DCCP socket is disconnected and dccp_sendmsg() is called after it, it will cause a NULL pointer dereference in dccp_write_xmit(). This crash and the reproducer was reported by syzbot. Looks like it is reproduced if commit 69c64866ce ("dccp: CVE-2017-8824: use-after-free in DCCP code") is applied. Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-03-07 13:38:56 -05:00
..
ccids
ackvec.c
ackvec.h
ccid.c
ccid.h
dccp.h
diag.c
feat.c
feat.h
input.c
ipv4.c
ipv6.c
ipv6.h
Kconfig
Makefile
minisocks.c
options.c
output.c
proto.c	dccp: check sk for closed state in dccp_sendmsg()	2018-03-07 13:38:56 -05:00
qpolicy.c
sysctl.c
timer.c
trace.h