[PATCH 0/1] sctp: check return value of sctp_get_af_specific in sctp_process_init

[Yuchao Zhang]

This patch fixes a NULL pointer dereference in sctp_process_init()
that a remote peer can trigger on kernels built with CONFIG_IPV6=n.

Problem description:
In sctp_process_init(), when a COOKIE ECHO arrives from a source
address different from the one recorded in its cookie, the embedded
address parameters of the INIT chunk carried in the cookie are walked
to re-validate the source:

	af = sctp_get_af_specific(param_type2af(param.p->type));
	if (!af->from_addr_param(&addr, param.addr,
				 chunk->sctp_hdr->source, 0))
		continue;

On CONFIG_IPV6=n kernels the IPv6 address family is never registered
and sctp_get_af_specific(AF_INET6) returns NULL.  A peer that completes
the INIT/INIT ACK exchange over IPv4 with an SCTP_PARAM_IPV6_ADDRESS
parameter embedded in its INIT, and then sends the COOKIE ECHO from a
different source address (as a multihomed peer legitimately may), makes
the walk dereference NULL, crashing the kernel in softirq context
without any authentication.

Fix:
Add an explicit NULL check for af in sctp_process_init() to skip
unsupported address family parameters, aligning with the other
from_addr_param call sites in net/sctp/input.c and
net/sctp/sm_make_chunk.c.

Tested and verified style-compliant with checkpatch.pl
(0 errors, 0 warnings).

Yuchao Zhang (1):
  sctp: check return value of sctp_get_af_specific in sctp_process_init

 net/sctp/sm_make_chunk.c | 2 ++
 1 file changed, 2 insertions(+)

-- 
2.53.0