Re: [PATCH] sctp: diag: fix uninitialized stack leak via INET_DIAG_LOCALS/PEERS
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-07-21 21:06:59
Also in:
linux-sctp, lkml, stable
On Wed, 15 Jul 2026 11:35:36 +0800 MingXuan wrote:
Fixes: 8f840e47f190cbe61a96945c13e9551048d42cef ("sctp: add the sctp_diag.c file")Please trim the commit hash per recommended format of the Fixes tag
quoted hunk ↗ jump to hunk
Cc: stable@vger.kernel.org Signed-off-by: MingXuan <redacted> --- net/sctp/diag.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)diff --git a/net/sctp/diag.c b/net/sctp/diag.c index d758f5c3e06e..12557e924cc2 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c@@ -85,8 +85,12 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb, info = nla_data(attr); rcu_read_lock(); list_for_each_entry_rcu(laddr, address_list, list) { - memcpy(info, &laddr->a, sizeof(laddr->a)); - memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a)); + size_t addr_len = laddr->a.sa.sa_family == AF_INET ? + sizeof(struct sockaddr_in) : + sizeof(struct sockaddr_in6); + + memset(info, 0, addrlen); + memcpy(info, &laddr->a, addr_len);
Having a variables called addrlen and addr_len in the same context is quite confusing. Can you come up with a better name? -- pw-bot: cr