The check of new_asoc->peer.adaptation_ind can fail, leaving ai_ev unitilialized. In that case, the code can jump to the nomem_authdev label and later call sctp_ulpevent_free() with a null ai_ev pointer. Leading to potential null dereference. Add check of ai_ev pointer before call of sctp_ulpevent_free function. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") Signed-off-by: Alexey Simakov --- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index a0524ba8d787..93cac73472c7 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, return SCTP_DISPOSITION_CONSUME; nomem_authev: - sctp_ulpevent_free(ai_ev); + if (ai_ev) + sctp_ulpevent_free(ai_ev); nomem_aiev: sctp_ulpevent_free(ev); nomem_ev: -- 2.34.1 I already have sent this patch from another email, but he wasnt applicable since company mail server corrupt it.