Commit 441f0647 authored Oct 21, 2025 by Alexey Simakov Committed by Jakub Kicinski Oct 22, 2025

sctp: avoid NULL dereference when chunk data buffer is missing



chunk->skb pointer is dereferenced in the if-block where it's supposed
to be NULL only.

chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list
instead and do it just before replacing chunk->skb. We're sure that
otherwise chunk->skb is non-NULL because of outer if() condition.

Fixes: 90017acc ("sctp: Add GSO support")
Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/20251021130034.6333-1-bigalex934@gmail.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent a767957e

net/sctp/inqueue.c

+7 −6

Original line number	Diff line number	Diff line
		@@ -169,14 +169,15 @@ struct sctp_chunk sctp_inq_pop(struct sctp_inq queue)
		chunk->head_skb = chunk->skb;

		/* skbs with "cover letter" */
		if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len)
		chunk->skb = skb_shinfo(chunk->skb)->frag_list;

		if (WARN_ON(!chunk->skb)) {
		__SCTP_INC_STATS(dev_net(chunk->skb->dev), SCTP_MIB_IN_PKT_DISCARDS);
		if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) {
		if (WARN_ON(!skb_shinfo(chunk->skb)->frag_list)) {
		__SCTP_INC_STATS(dev_net(chunk->skb->dev),
		SCTP_MIB_IN_PKT_DISCARDS);
		sctp_chunk_free(chunk);
		goto next_chunk;
		}
		chunk->skb = skb_shinfo(chunk->skb)->frag_list;
		}
		}

		if (chunk->asoc)