Commit 168bd51e authored Feb 07, 2017 by Xin Long Committed by Greg Kroah-Hartman Jul 05, 2017

sctp: check af before verify address in sctp_addr_id2transport




[ Upstream commit 912964eacb111551db73429719eb5fadcab0ff8a ]

Commit 6f29a1306131 ("sctp: sctp_addr_id2transport should verify the
addr before looking up assoc") invoked sctp_verify_addr to verify the
addr.

But it didn't check af variable beforehand, once users pass an address
with family = 0 through sockopt, sctp_get_af_specific will return NULL
and NULL pointer dereference will be caused by af->sockaddr_len.

This patch is to fix it by returning NULL if af variable is NULL.

Fixes: 6f29a1306131 ("sctp: sctp_addr_id2transport should verify the addr before looking up assoc")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 399566f8

net/sctp/socket.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -239,7 +239,7 @@ static struct sctp_transport sctp_addr_id2transport(struct sock sk,
		union sctp_addr laddr = (union sctp_addr )addr;
		struct sctp_transport *transport;

		if (sctp_verify_addr(sk, laddr, af->sockaddr_len))
		if (!af \|\| sctp_verify_addr(sk, laddr, af->sockaddr_len))
		return NULL;

		addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,