diff options
| author | Alexandr Sapozhnikov <alsp705@gmail.com> | 2025-10-02 12:14:47 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-19 16:30:43 +0200 |
| commit | c21f45cfa4a9526b34d76b397c9ef080668b6e73 (patch) | |
| tree | 935fbf7f165fa87fdff8d356712a4c9f57dcd59c /net | |
| parent | 77e402b0af5e5a8fcfa43034fd5efdcec2507a1b (diff) | |
| download | linux-c21f45cfa4a9526b34d76b397c9ef080668b6e73.tar.gz linux-c21f45cfa4a9526b34d76b397c9ef080668b6e73.tar.bz2 linux-c21f45cfa4a9526b34d76b397c9ef080668b6e73.zip | |
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
and sctp_ulpevent_make_authkey() returns 0, then the variable
ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sctp/sm_statefuns.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 808863e047e0..2d88654e8d8e 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -884,7 +884,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, return SCTP_DISPOSITION_CONSUME; nomem_authev: - sctp_ulpevent_free(ai_ev); + if (ai_ev) + sctp_ulpevent_free(ai_ev); nomem_aiev: sctp_ulpevent_free(ev); nomem_ev: |