[PATCH 1/1] sctp: check return value of sctp_get_af_specific in sctp_process_init

[Yuchao Zhang]

In sctp_process_init(), when matching the source address of a COOKIE
ECHO against the embedded address parameters of the INIT chunk carried
in the cookie, the address family handler is dereferenced without a
NULL check:

	af = sctp_get_af_specific(param_type2af(param.p->type));
	if (!af->from_addr_param(&addr, param.addr,
				 chunk->sctp_hdr->source, 0))
		continue;

On kernels built without IPv6 (CONFIG_IPV6=n) sctp_af_v6_specific is
never registered and sctp_get_af_specific(AF_INET6) returns NULL.  A
remote peer can reach this path by completing a regular INIT/INIT ACK
exchange over IPv4 with an SCTP_PARAM_IPV6_ADDRESS parameter embedded
in its INIT (ignored at INIT time by the address family gate in
sctp_process_param(), but the cookie embeds the whole INIT chunk), and
then sending the COOKIE ECHO from a different source address, e.g. a
second interface of a multihomed peer.  sctp_unpack_cookie() does not
compare the packet source address against the peer address stored in
the cookie, so src_match is 0 and the walk dereferences the NULL af.

This crashes the kernel with a NULL pointer dereference in softirq
context, remotely and without authentication.

The other from_addr_param call sites of the same family already check
af (__sctp_rcv_init_lookup() and the ASCONF path in
sctp_process_param(), fixed by commit e40607cbe270 ("net: sctp: fix
NULL pointer dereference in af->from_addr_param on malformed packet")),
which missed this one.

Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yuchao Zhang <ndaugoing@xxxxxxxxx>
---
 net/sctp/sm_make_chunk.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 84a4c97d0f75..ff1c013e2575 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2381,6 +2381,8 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
 		    (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
 		     param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
 			af = sctp_get_af_specific(param_type2af(param.p->type));
+			if (!af)
+				continue;
 			if (!af->from_addr_param(&addr, param.addr,
 						 chunk->sctp_hdr->source, 0))
 				continue;
-- 
2.53.0