From: Alexey Kodanev <[email protected]>
Date: Mon, 21 May 2018 19:28:44 +0300
> Syzbot reported the use-after-free in timer_is_static_object() [1].
>
> This can happen because the structure for the rto timer (ccid2_hc_tx_sock)
> is removed in dccp_disconnect(), and ccid2_hc_tx_rto_expire() can be
> called after that.
>
> The report [1] is similar to the one in commit 120e9dabaf55 ("dccp:
> defer ccid_hc_tx_delete() at dismantle time"). And the fix is the same,
> delay freeing ccid2_hc_tx_sock structure, so that it is freed in
> dccp_sk_destruct().
...
> Reported-by: [email protected]
> Signed-off-by: Alexey Kodanev <[email protected]>
Applied and queued up for -stable, thanks.
