Re: [PATCH net] sctp: validate the body of a STALE_COOKIE error before reading it

Thanks for the reminder. I didn't notice that Weiming has patched it.
Sorry about that.

Xiang

On Sun, Jul 5, 2026 at 12:13 PM Xin Long [off-list ref] wrote:

On Sat, Jul 4, 2026 at 8:31 PM Xiang Mei [off-list ref] wrote:

quoted

sctp_sf_do_5_2_6_stale() reads the 32-bit Measure of Staleness that
follows the error header:

        stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));

without checking that the STALE_COOKIE cause actually carries that
4-byte body. sctp_walk_errors() in the caller only requires
err->length >= sizeof(struct sctp_errhdr), so a peer can send an 8-byte
ERROR chunk whose sole STALE_COOKIE cause has length == 4 and no body.
It passes sctp_chunk_length_valid() (>= 8) and the error walk, yet the
staleness read reaches past the validated cause.

When that is the only chunk in the packet the cause ends exactly at
skb_tail (sctp_inq_pop() discards only when chunk_end > skb_tail), so
the read stays in-bounds of the skb head slab object but past the packet
data. The value is folded into the COOKIE_PRESERVATIVE parameter of the
retransmitted INIT and reflected to the peer, leaking adjacent kernel
slab bytes.

Discard the chunk when the staleness field falls outside the validated
chunk data.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Weiming Shi <redacted>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <redacted>
---
 net/sctp/sm_statefuns.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index d23d935e128e..e4b4b63162cf 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c

@@ -2592,6 +2592,9 @@ static enum sctp_disposition sctp_sf_do_5_2_6_stale(

        err = (struct sctp_errhdr *)(chunk->skb->data);

+       if ((u8 *)err + sizeof(*err) + sizeof(__be32) > chunk->chunk_end)
+               return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
        /* When calculating the time extension, an implementation
         * SHOULD use the RTT information measured based on the
         * previous COOKIE ECHO / ERROR exchange, and should add no
--

2.43.0

I think this is a dup of
https://lore.kernel.org/netdev/20260704033545.2438373-2-bestswngs@gmail.com/ (local).

Thanks.