Re: [PATCH net] dccp: fix use-after-free in dccp_feat_activate_values

From: Eric Dumazet <redacted>
Date: Sun, 05 Mar 2017 10:52:16 -0800

From: Eric Dumazet <edumazet@google.com>

Dmitry reported crashes in DCCP stack [1]

Problem here is that when I got rid of listener spinlock, I missed the
fact that DCCP stores a complex state in struct dccp_request_sock,
while TCP does not.

Since multiple cpus could access it at the same time, we need to add
protection.

 ...

Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>

Applied and queued up for -stable.