tree 532784df2f1c8e938f015e9f52c6fe7ae23981e4
parent 72961d91696071841fa013f11f686eaa7e2d0996
author Mathias Krause <minipli@googlemail.com> 1345030314 +0000
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1347642034 -0700

dccp: check ccid before dereferencing

commit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f upstream.

ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
a NULL ccid pointer leading to a NULL pointer dereference. This could
lead to a privilege escalation if the attacker is able to map page 0 and
prepare it with a fake ccid_ops pointer.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>