Re: [PATCH] net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Xin Long <[email protected]>
| Newsgroups | org.kernel.vger.linux-sctp,org.kernel.vger.linux-kernel,org.kernel.vger.netdev |
|---|---|
| Message-ID | <CADvbK_frvOEC4-UbuYixCu2RbQuAOQLmTsi5-sGnO8_+ZSpT8A@mail.gmail.com> |
On Thu, Oct 2, 2025 at 5:14 AM Alexandr Sapozhnkiov <[email protected]> wrote: > > From: Alexandr Sapozhnikov <[email protected]> > > If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 > and sctp_ulpevent_make_authkey() returns 0, then the variable > ai_ev remains zero and the zero will be dereferenced > in the sctp_ulpevent_free() function. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Alexandr Sapozhnikov <[email protected]> Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") Acked-by: Xin Long <[email protected]>