Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e5117101 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki
Browse files

[SCTP]: Fix NULL dereference of asoc. 



Commit 7cbca67c ("[IPV6]: Support
Source Address Selection API (RFC5014)") introduced NULL dereference
of asoc to sctp_v6_get_saddr in net/sctp/ipv6.c.
Pointed out by Johann Felix Soden <johfel@users.sourceforge.net>.

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
parent 7dccf1f4

include/net/sctp/structs.h

+2 −1
Original line number Diff line number Diff line
@@ -548,7 +548,8 @@ struct sctp_af { 
	struct dst_entry *(*get_dst)	(struct sctp_association *asoc,

					 union sctp_addr *daddr,

					 union sctp_addr *saddr);

	void		(*get_saddr)	(struct sctp_association *asoc,

	void		(*get_saddr)	(struct sctp_sock *sk,

					 struct sctp_association *asoc,

					 struct dst_entry *dst,

					 union sctp_addr *daddr,

					 union sctp_addr *saddr);

net/sctp/ipv6.c

+3 −2
Original line number Diff line number Diff line
@@ -299,7 +299,8 @@ static inline int sctp_v6_addr_match_len(union sctp_addr *s1, 
/* Fills in the source address(saddr) based on the destination address(daddr)

 * and asoc's bind address list.

 */

static void sctp_v6_get_saddr(struct sctp_association *asoc,

static void sctp_v6_get_saddr(struct sctp_sock *sk,

			      struct sctp_association *asoc,

			      struct dst_entry *dst,

			      union sctp_addr *daddr,

			      union sctp_addr *saddr)
@@ -318,7 +319,7 @@ static void sctp_v6_get_saddr(struct sctp_association *asoc, 
	if (!asoc) {

		ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,

				   &daddr->v6.sin6_addr,

				   inet6_sk(asoc->base.sk)->srcprefs,

				   inet6_sk(&sk->inet.sk)->srcprefs,

				   &saddr->v6.sin6_addr);

		SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: " NIP6_FMT "\n",

				  NIP6(saddr->v6.sin6_addr));

net/sctp/protocol.c

+2 −1
Original line number Diff line number Diff line
@@ -519,7 +519,8 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc, 
/* For v4, the source address is cached in the route entry(dst). So no need

 * to cache it separately and hence this is an empty routine.

 */

static void sctp_v4_get_saddr(struct sctp_association *asoc,

static void sctp_v4_get_saddr(struct sctp_sock *sk,

			      struct sctp_association *asoc,

			      struct dst_entry *dst,

			      union sctp_addr *daddr,

			      union sctp_addr *saddr)

net/sctp/transport.c

+1 −1
Original line number Diff line number Diff line
@@ -291,7 +291,7 @@ void sctp_transport_route(struct sctp_transport *transport, 
	if (saddr)

		memcpy(&transport->saddr, saddr, sizeof(union sctp_addr));

	else

		af->get_saddr(asoc, dst, daddr, &transport->saddr);

		af->get_saddr(opt, asoc, dst, daddr, &transport->saddr);



	transport->dst = dst;

	if ((transport->param_flags & SPP_PMTUD_DISABLE) && transport->pathmtu) {