git: 91d1c1c2b1e7 - stable/15 - pfsync: reject invalid SCTP states

The branch stable/15 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=91d1c1c2b1e74e776641a0923a9796b018c610d2

commit 91d1c1c2b1e74e776641a0923a9796b018c610d2
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-05-04 16:08:35 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-05-12 07:54:34 +0000

    pfsync: reject invalid SCTP states
    
    SCTP states should always have a src scrub object associated with them.
    Crafted pfsync packets might not have this, leading to us derferencing a
    NULL pointer on cleanup.
    
    Validate the pfsync state insertion packet to make sure this is correct.
    
    PR:             294989
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    
    (cherry picked from commit bf6d00afdb6171ba04a1c5a7fde904cde87d212d)
---
 sys/netpfil/pf/if_pfsync.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index 3edf08aefeb5..a5f377e84307 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -873,6 +873,13 @@ pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version)
 	    (st->act.rtableid >= 0 && st->act.rtableid < rt_numfibs)))
 		goto cleanup;
 
+	if (sks->proto == IPPROTO_SCTP && st->src.scrub == NULL) {
+		if (V_pf_status.debug >= PF_DEBUG_MISC)
+			printf("%s: invalid SCTP state from creator id: %08x\n", __func__,
+			    ntohl(sp->pfs_1301.creatorid));
+		goto cleanup;
+	}
+
 	st->id = sp->pfs_1301.id;
 	st->creatorid = sp->pfs_1301.creatorid;
 	pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src);