[PATCH 0/1] sctp: check return value of sctp_get_af_specific in sctp_process_init

[PATCH 0/1] sctp: check return value of sctp_get_af_specific in sctp_process_init

[Yuchao Zhang]

This patch fixes a NULL pointer dereference in sctp_process_init()
that a remote peer can trigger on kernels built with CONFIG_IPV6=n.

Problem description:
In sctp_process_init(), when a COOKIE ECHO arrives from a source
address different from the one recorded in its cookie, the embedded
address parameters of the INIT chunk carried in the cookie are walked
to re-validate the source:

	af = sctp_get_af_specific(param_type2af(param.p->type));
	if (!af->from_addr_param(&addr, param.addr,
				 chunk->sctp_hdr->source, 0))
		continue;

On CONFIG_IPV6=n kernels the IPv6 address family is never registered
and sctp_get_af_specific(AF_INET6) returns NULL.  A peer that completes
the INIT/INIT ACK exchange over IPv4 with an SCTP_PARAM_IPV6_ADDRESS
parameter embedded in its INIT, and then sends the COOKIE ECHO from a
different source address (as a multihomed peer legitimately may), makes
the walk dereference NULL, crashing the kernel in softirq context
without any authentication.

Fix:
Add an explicit NULL check for af in sctp_process_init() to skip
unsupported address family parameters, aligning with the other
from_addr_param call sites in net/sctp/input.c and
net/sctp/sm_make_chunk.c.

Tested and verified style-compliant with checkpatch.pl
(0 errors, 0 warnings).

Yuchao Zhang (1):
  sctp: check return value of sctp_get_af_specific in sctp_process_init

 net/sctp/sm_make_chunk.c | 2 ++
 1 file changed, 2 insertions(+)

-- 
2.53.0

[PATCH 1/1] sctp: check return value of sctp_get_af_specific in sctp_process_init

[Yuchao Zhang]

In sctp_process_init(), when matching the source address of a COOKIE
ECHO against the embedded address parameters of the INIT chunk carried
in the cookie, the address family handler is dereferenced without a
NULL check:

	af = sctp_get_af_specific(param_type2af(param.p->type));
	if (!af->from_addr_param(&addr, param.addr,
				 chunk->sctp_hdr->source, 0))
		continue;

On kernels built without IPv6 (CONFIG_IPV6=n) sctp_af_v6_specific is
never registered and sctp_get_af_specific(AF_INET6) returns NULL.  A
remote peer can reach this path by completing a regular INIT/INIT ACK
exchange over IPv4 with an SCTP_PARAM_IPV6_ADDRESS parameter embedded
in its INIT (ignored at INIT time by the address family gate in
sctp_process_param(), but the cookie embeds the whole INIT chunk), and
then sending the COOKIE ECHO from a different source address, e.g. a
second interface of a multihomed peer.  sctp_unpack_cookie() does not
compare the packet source address against the peer address stored in
the cookie, so src_match is 0 and the walk dereferences the NULL af.

This crashes the kernel with a NULL pointer dereference in softirq
context, remotely and without authentication.

The other from_addr_param call sites of the same family already check
af (__sctp_rcv_init_lookup() and the ASCONF path in
sctp_process_param(), fixed by commit e40607cbe270 ("net: sctp: fix
NULL pointer dereference in af->from_addr_param on malformed packet")),
which missed this one.

Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
---
 net/sctp/sm_make_chunk.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 84a4c97d0f75..ff1c013e2575 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2381,6 +2381,8 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
 		    (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
 		     param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
 			af = sctp_get_af_specific(param_type2af(param.p->type));
+			if (!af)
+				continue;
 			if (!af->from_addr_param(&addr, param.addr,
 						 chunk->sctp_hdr->source, 0))
 				continue;
-- 
2.53.0