[PATCH net] sctp: account for chunk padding in sctp_init_cause()

[PATCH net] sctp: account for chunk padding in sctp_init_cause()

[Masafumi Suzuki]

sctp_init_cause() accepts a chunk when skb_tailroom() can hold the
cause header and the payload. sctp_addto_chunk() then writes 0-3
bytes of padding before that header so the chunk stays 4-byte
aligned. The check does not include the padding, and the following
skb_put() calls skb_over_panic() from softirq.

Count the padding sctp_addto_chunk() is about to write. The cause
length on the wire stays the header plus the payload.

Fixes: 8914f4bace3f ("sctp: add sctp_make_op_error_limited and reuse inner functions")
Cc: stable@vger.kernel.org
Signed-off-by: Masafumi Suzuki <shengshilingmu97@gmail.com>
---
 net/sctp/sm_make_chunk.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 84a4c97d0f75..8933caadcdb6 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -133,20 +133,27 @@ static const struct sctp_paramhdr prsctp_param = {
  * cause codes will be embedded inside an abort chunk.
  */
 int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
 		    size_t paylen)
 {
 	struct sctp_errhdr err;
+	int chunklen, padlen;
 	__u16 len;
 
 	/* Cause code constants are now defined in network order.  */
 	err.cause = cause_code;
 	len = sizeof(err) + paylen;
 	err.length = htons(len);
 
-	if (skb_tailroom(chunk->skb) < len)
+	/* sctp_addto_chunk() pads the chunk up to a 4-byte boundary before
+	 * appending the cause, so account for that padding here as well.
+	 */
+	chunklen = ntohs(chunk->chunk_hdr->length);
+	padlen = SCTP_PAD4(chunklen) - chunklen;
+
+	if (skb_tailroom(chunk->skb) < padlen + len)
 		return -ENOSPC;
 
 	chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(err), &err);
 
 	return 0;
 }
-- 
2.47.0

Re: [PATCH net] sctp: account for chunk padding in sctp_init_cause()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] sctp: account for chunk padding in sctp_init_cause()

[ソーストマト]

The missing tailroom was found by reading sctp_init_cause()
against the padding that sctp_addto_chunk() writes first.
AI assistance was used for that reading.

The bug was triggered, not only found by inspection. The panic
was confirmed on local virtual machines running 7.3.0-rc7 and
7.3.0-ga1c2b1da93f5 (CONFIG_KASAN unset). The symptom is a
softirq panic:

  kernel BUG at net/core/skbuff.c:214!
  Kernel panic - not syncing: Fatal exception in interrupt

skb_put() calls skb_over_panic() before the copy. The observed
pointers were tail 0x6c1 and end 0x6c0. The same panic occurred
for a listening socket, an established association, and an
unprivileged client socket.


2026年10月27日(火) 17:50 ソーストマト <shengshilingmu97@gmail.com>:
>
> The missing tailroom was found by reading sctp_init_cause()
> against the padding that sctp_addto_chunk() writes first.
> AI assistance was used for that reading.
>
> The bug was triggered, not only found by inspection. The panic
> was confirmed on local virtual machines running 7.3.0-rc7 and
> 7.3.0-ga1c2b1da93f5 (CONFIG_KASAN unset). The symptom is a
> softirq panic:
>
>   kernel BUG at net/core/skbuff.c:214!
>   Kernel panic - not syncing: Fatal exception in interrupt
>
> skb_put() calls skb_over_panic() before the copy. The observed
> pointers were tail 0x6c1 and end 0x6c0. The same panic occurred
> for a listening socket, an established association, and an
> unprivileged client socket.
>
> 2026年10月27日(火) 17:35 <netdev-bot+sinfo@kernel.org>:
>>
>> Hi!
>>
>> This is an automated message. This series looks like a fix, but its
>> commit messages seem to be missing some information:
>>
>>  - How the issue was discovered, e.g. hit in production, hit during
>>    development, syzbot report, manual code inspection, LLM or static
>>    analysis tool scan.
>>
>>  - Whether the issue was actually triggered, or is only theoretical
>>    (e.g. found by code inspection). If it was triggered please include
>>    the symptoms, like the stack trace or error messages.
>>
>> Please do not repost the series just to address the above. Instead,
>> reply to this email with the missing information, so that reviewers
>> can take it into account. If the series needs another revision for
>> other reasons, please include the information in the commit messages
>> then.
>>
>> The evaluation is done by an LLM so it may be wrong, if you think
>> that is the case please reply and explain.