Skip to content

Commit 2f31196

Browse files
Alexandr Sapozhnikovkuba-moo
authored andcommitted
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced in the sctp_ulpevent_free() function. Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com> Acked-by: Xin Long <lucien.xin@gmail.com> Fixes: 30f6ebf ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 1b54b07 commit 2f31196

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

net/sctp/sm_statefuns.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -886,7 +886,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
886886
return SCTP_DISPOSITION_CONSUME;
887887

888888
nomem_authev:
889-
sctp_ulpevent_free(ai_ev);
889+
if (ai_ev)
890+
sctp_ulpevent_free(ai_ev);
890891
nomem_aiev:
891892
sctp_ulpevent_free(ev);
892893
nomem_ev:

0 commit comments

Comments
 (0)