Re: [PATCH 1/1] sctp: check return value of sctp_get_af_specific in sctp_process_init

[Xin Long]

On Thu, Sep 17, 2026 at 11:39 PM Yuchao Zhang <ndaugoing@xxxxxxxxx> wrote:
>
> In sctp_process_init(), when matching the source address of a COOKIE
> ECHO against the embedded address parameters of the INIT chunk carried
> in the cookie, the address family handler is dereferenced without a
> NULL check:
>
>         af = sctp_get_af_specific(param_type2af(param.p->type));
>         if (!af->from_addr_param(&addr, param.addr,
>                                  chunk->sctp_hdr->source, 0))
>                 continue;
>
> On kernels built without IPv6 (CONFIG_IPV6=n) sctp_af_v6_specific is
> never registered and sctp_get_af_specific(AF_INET6) returns NULL.  A
> remote peer can reach this path by completing a regular INIT/INIT ACK
> exchange over IPv4 with an SCTP_PARAM_IPV6_ADDRESS parameter embedded
> in its INIT (ignored at INIT time by the address family gate in
> sctp_process_param(), but the cookie embeds the whole INIT chunk), and
> then sending the COOKIE ECHO from a different source address, e.g. a
> second interface of a multihomed peer.  sctp_unpack_cookie() does not
> compare the packet source address against the peer address stored in
> the cookie, so src_match is 0 and the walk dereferences the NULL af.
>
> This crashes the kernel with a NULL pointer dereference in softirq
> context, remotely and without authentication.
>
> The other from_addr_param call sites of the same family already check
> af (__sctp_rcv_init_lookup() and the ASCONF path in
> sctp_process_param(), fixed by commit e40607cbe270 ("net: sctp: fix
> NULL pointer dereference in af->from_addr_param on malformed packet")),
> which missed this one.
>
> Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yuchao Zhang <ndaugoing@xxxxxxxxx>
> ---
>  net/sctp/sm_make_chunk.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> index 84a4c97d0f75..ff1c013e2575 100644
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -2381,6 +2381,8 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
>                     (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
>                      param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
>                         af = sctp_get_af_specific(param_type2af(param.p->type));
> +                       if (!af)
> +                               continue;
>                         if (!af->from_addr_param(&addr, param.addr,
>                                                  chunk->sctp_hdr->source, 0))
>                                 continue;
> --
> 2.53.0
>

I think this is a dup of
https://lore.kernel.org/netdev/20260917030505.4176635-1-hdthky0@xxxxxxxxx/

Thanks.