[PATCH net] sctp: preserve the last transport during INIT error cleanup

[Lin Jiapeng <ljp1205831794@gmail.com>]

From: Lin Jiapeng <jiapenglin@tencent.com>

On failure, sctp_process_init() removes all non-ACTIVE peer transports.
An existing UNCONFIRMED transport is not promoted to ACTIVE by
sctp_assoc_add_peer(), so cleanup can remove the last transport.

sctp_assoc_rm_peer() assumes another transport remains after removal.
If the list becomes empty, it interprets the list head as a transport
and passes the invalid replacement to sctp_assoc_set_primary() when
removing the primary path, causing a NULL pointer dereference:

	Oops: general protection fault, probably for non-canonical address 0xdffffc0000000045: 0000 [#1] SMP KASAN NOPTI
	KASAN: null-ptr-deref in range [0x0000000000000228-0x000000000000022f]
	RIP: 0010:sctp_ulpevent_notify_peer_addr_change+0x73/0xba0
	Call Trace:
	 <IRQ>
	 sctp_assoc_rm_peer+0x186/0x9b0
	 sctp_process_init+0x1ff4/0x2810
	 sctp_do_sm+0x1c97/0x4560
	 sctp_assoc_bh_rcv+0x30b/0x630
	 sctp_rcv+0xb63/0x1220
	Kernel panic - not syncing: Fatal exception in interrupt

Keep the last transport during cleanup so sctp_assoc_rm_peer() has a
valid replacement. The retained transport is freed when the association
is destroyed.

Fixes: add52379dde2 ("sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH")
Cc: stable@vger.kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Signed-off-by: Lin Jiapeng <jiapenglin@tencent.com>
---
 net/sctp/sm_make_chunk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 15c2d87575a8..e4b7dacf174e 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2528,7 +2528,8 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
 	/* Release the transport structures. */
 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
 		transport = list_entry(pos, struct sctp_transport, transports);
-		if (transport->state != SCTP_ACTIVE)
+		if (transport->state != SCTP_ACTIVE &&
+		    !list_is_singular(&asoc->peer.transport_addr_list))
 			sctp_assoc_rm_peer(asoc, transport);
 	}
 

base-commit: 145480b28ca82e9fae789427cc4569e596515a32
-- 
2.55.0