sctp: avoid NULL dereference when chunk data buffer is missing

chunk->skb pointer is dereferenced in the if-block where it's supposed
to be NULL only.

chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list
instead and do it just before replacing chunk->skb. We're sure that
otherwise chunk->skb is non-NULL because of outer if() condition.

Fixes: 90017accff61 ("sctp: Add GSO support")
Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/20251021130034.6333-1-bigalex934@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 5c1652181805880ff9f5eaae45e0bab6b00170df..f5a7d5a38755551c99bd74cd677935982cc0155e 100644 (file)
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -169,13 +169,14 @@ next_chunk:
                                chunk->head_skb = chunk->skb;
 
                        /* skbs with "cover letter" */
-                       if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len)
+                       if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) {
+                               if (WARN_ON(!skb_shinfo(chunk->skb)->frag_list)) {
+                                       __SCTP_INC_STATS(dev_net(chunk->skb->dev),
+                                                        SCTP_MIB_IN_PKT_DISCARDS);
+                                       sctp_chunk_free(chunk);
+                                       goto next_chunk;
+                               }
                                chunk->skb = skb_shinfo(chunk->skb)->frag_list;
-
-                       if (WARN_ON(!chunk->skb)) {
-                               __SCTP_INC_STATS(dev_net(chunk->skb->dev), SCTP_MIB_IN_PKT_DISCARDS);
-                               sctp_chunk_free(chunk);
-                               goto next_chunk;
                        }
                }