]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
sctp: avoid NULL dereference when chunk data buffer is missing
authorAlexey Simakov <bigalex934@gmail.com>
Tue, 21 Oct 2025 13:00:36 +0000 (16:00 +0300)
committerJakub Kicinski <kuba@kernel.org>
Thu, 23 Oct 2025 02:19:31 +0000 (19:19 -0700)
commit441f0647f7673e0e64d4910ef61a5fb8f16bfb82
tree4cd84c10fd08d680f567eddd285bab0c93ef408f
parenta767957e7a83f9e742be196aa52a48de8ac5a7e4
sctp: avoid NULL dereference when chunk data buffer is missing

chunk->skb pointer is dereferenced in the if-block where it's supposed
to be NULL only.

chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list
instead and do it just before replacing chunk->skb. We're sure that
otherwise chunk->skb is non-NULL because of outer if() condition.

Fixes: 90017accff61 ("sctp: Add GSO support")
Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/20251021130034.6333-1-bigalex934@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/sctp/inqueue.c