In sctp_process_init(), when matching the source address of a COOKIE ECHO against the embedded address parameters of the INIT chunk carried in the cookie, the address family handler is dereferenced without a NULL check: af = sctp_get_af_specific(param_type2af(param.p->type)); if (!af->from_addr_param(&addr, param.addr, chunk->sctp_hdr->source, 0)) continue; On kernels built without IPv6 (CONFIG_IPV6=n) sctp_af_v6_specific is never registered and sctp_get_af_specific(AF_INET6) returns NULL. A remote peer can reach this path by completing a regular INIT/INIT ACK exchange over IPv4 with an SCTP_PARAM_IPV6_ADDRESS parameter embedded in its INIT (ignored at INIT time by the address family gate in sctp_process_param(), but the cookie embeds the whole INIT chunk), and then sending the COOKIE ECHO from a different source address, e.g. a second interface of a multihomed peer. sctp_unpack_cookie() does not compare the packet source address against the peer address stored in the cookie, so src_match is 0 and the walk dereferences the NULL af. This crashes the kernel with a NULL pointer dereference in softirq context, remotely and without authentication. The other from_addr_param call sites of the same family already check af (__sctp_rcv_init_lookup() and the ASCONF path in sctp_process_param(), fixed by commit e40607cbe270 ("net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet")), which missed this one. Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return") Cc: stable@vger.kernel.org Signed-off-by: Yuchao Zhang --- net/sctp/sm_make_chunk.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 84a4c97d0f75..ff1c013e2575 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -2381,6 +2381,8 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk, (param.p->type == SCTP_PARAM_IPV4_ADDRESS || param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { af = sctp_get_af_specific(param_type2af(param.p->type)); + if (!af) + continue; if (!af->from_addr_param(&addr, param.addr, chunk->sctp_hdr->source, 0)) continue; -- 2.53.0