From: Qing Luo <redacted>

When processing AUTH + COOKIE-ECHO packets in sctp_assoc_bh_rcv()
and sctp_endpoint_bh_rcv(), the AUTH chunk skb is cloned and
saved as chunk->auth_chunk for deferred verification. However,
when skb_clone() fails under memory pressure, chunk->auth_chunk
is set to NULL but chunk->auth is still unconditionally set to 1.

This creates an inconsistent state where the chunk appears to be
authenticated (auth == 1) but has no auth_chunk data to actually
verify against. Later, sctp_auth_chunk_verify() sees a NULL
auth_chunk and returns true, skipping authentication entirely
and allowing unauthenticated COOKIE-ECHO packets to be accepted.

Fix this by only setting chunk->auth = 1 when skb_clone()
succeeds, ensuring the auth flag accurately reflects whether
a valid auth_chunk is available for verification.

Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk")
Signed-off-by: Qing Luo <redacted>
---
 net/sctp/associola.c   | 3 ++-
 net/sctp/endpointola.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 62d3cc155809..e54068305396 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c

@@ -999,7 +999,8 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
 			if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
 				chunk->auth_chunk = skb_clone(chunk->skb,
 							      GFP_ATOMIC);
-				chunk->auth = 1;
+				if (chunk->auth_chunk)
+					chunk->auth = 1;
 				continue;
 			}
 		}

diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index dfb1719275db..3419748c66bc 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c

@@ -368,7 +368,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
 			if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
 				chunk->auth_chunk = skb_clone(chunk->skb,
 								GFP_ATOMIC);
-				chunk->auth = 1;
+				if (chunk->auth_chunk)
+					chunk->auth = 1;
 				continue;
 			}
 		}

-- 
2.25.1