Re: [PATCH v2 net] sctp: avoid NULL dereference when chunk data buffer is missing
Marcelo Ricardo Leitner <[email protected]>
| Newsgroups | org.kernel.vger.linux-sctp,org.kernel.vger.linux-kernel,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
On Tue, Oct 21, 2025 at 04:00:36PM +0300, Alexey Simakov wrote:
> chunk->skb pointer is dereferenced in the if-block where it's supposed
> to be NULL only.
>
> chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list
> instead and do it just before replacing chunk->skb. We're sure that
> otherwise chunk->skb is non-NULL because of outer if() condition.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 90017accff61 ("sctp: Add GSO support")
> Signed-off-by: Alexey Simakov <[email protected]>
Acked-by: Marcelo Ricardo Leitner <[email protected]>
Thx.