From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA5D23B1EC7 for ; Fri, 5 Jun 2026 08:52:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780649554; cv=none; b=Mb3ZUk7nftiWJSCzehvXhYtdqszTd4qTR3TmwAx3t4mxtQ1y2mqHNQPJP9SiGqzxWEmopt39ZqLUHl1e0jK3gjAwOPSZQprsSqmW2lQwv3j1zHc1KjkQK68BOlC2BPjsq+zgBVSntFn3s9rt78AgohjtFFxO+QuHV+52yNZ0DVw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780649554; c=relaxed/simple; bh=/wI/UxY2JP6RcLCr7H6wSJdtL+VOLO3RPdEB5IDxA/k=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=R6kP1xaJxeNKt2aJmaRM5HXHiMCR4EaRC25nfsKNfncBNa/5ka4z3QjByAFt0V4ZuXbzvr1hqmBUK4HKwO4E/L/wnG08rSSQVfGw2Gd7mGZnPCo2DuttUhyLt8DvE+DHPeAAfMmlV1nYDTwvCzUkp71VtCea3pPEMw72cGGwBa8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UxlDRdTk; arc=none smtp.client-ip=209.85.221.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UxlDRdTk" Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-45eee266c6cso1304017f8f.1 for ; Fri, 05 Jun 2026 01:52:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780649550; x=1781254350; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=p+yeXgyUFJ16Hxtz3HlfZ6J7s+54zwh5KcpUkTsryFU=; b=UxlDRdTkZFexMTzeRiG8v4lS6xH7KcrrX8fVSE/gymCT5W0sZn2UgYvwpz0ZQQjKYA cQKhgdpgVBsVV8Xu/dCXR9EsORk8ogP9fJrRYKR0XOQMcr9jFH1LhorCTKEZzpQqulnm p54NjNPL4h8DnbbAGmhT1JjI8b8ydcstyK+3AzAuQxRLgTLZV8GTMYMNIAZX6X6kXbXy EfsyAuNUv0RLPQdXO0A+hMyninRGMQUePsIDaPoS5dHwA5oA+QNFAwncPKg17+U02scZ /0XdNokCN78dQFE3ic/MXdmXfWIDxF5zenW/ycGtl+4igQcumeLyfxEsc5Z//UeLpXa0 OQDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780649550; x=1781254350; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=p+yeXgyUFJ16Hxtz3HlfZ6J7s+54zwh5KcpUkTsryFU=; b=G9kx/vcBGE5W4dzyNlmrnWIUxnylwaTfJyy5IZLLRFuoVt9WjpKEsD42+102jQheD6 oL6CqjxCA6PGMoDr9SoTNg+dtoidM/I4FoHFMG6O0c93iJqDlpYAXemgiGfabw8Q/YRD /GFUhIfn2ufI9uzLnZDbtAsjellrBgBbEUeZi7Zx1YZqUjxbKdNbnHUcesswHNoIVar+ Ibio7BDIUqtKVLpAUNC0n0ePiCVJGSxHyIG1F8Yg3sN1P52AlFxXi0r2Tm+8OtsXIo57 gC/4kqgC7Gs8RdmIgVBxyr6cjxiKgn2y0FX/sJ1nb8kOCpuuPOC7bVdH71g/ifQbVCcO 3J0g== X-Forwarded-Encrypted: i=1; AFNElJ8xj1ape7jZpXb3qTuP5sAWfUT8bY0XkRyKAsVFvgxuMxkbCQ0kUzF1o4HrbJ/QpF+VxEY5yLZp9Gch39I=@vger.kernel.org X-Gm-Message-State: AOJu0Yyp1qJDeq0V5zCP/BojTMOZ0mAYMF6Z1/0EVojo4M89jIkEKpLK KVtNO/+lqLI+dK/jCEkI1da50bAuPlqGZGTczfiavMcwe+h6TEqm57U52ULv5Sht X-Gm-Gg: Acq92OHCqQv6GzdEp+apeFw76pHGw0C4RYOIkuLXa3Zsxn+sx3i6Pb0AtCL5AYpoX+Y esexiCr8mYag1bV8tcQm6dd/Ksq+G1fNVJqQyTEBb311o2ynkg8ZvJZr8krwvSnoU5ps8j95mUl E7ufA5E4GZ208Miq8YoyNJCEgW0OtagTvVsHbrN4g/iF25HHj+nuZfIBCzJOwQjqmLb+/v7XYRU gWDXdBamc8lEqIZizMEhMlR+b0xOPUehT9TaUjhDVIGB5BMNaLIygiq3hVp3MmBmMLGFpPJ4ljJ zXnfezUW8I+lO43RW3boY2lHYmqqA8Fj6U+LAP6G7pUdtS/FcPAdPVm9Sn2Qq9xBWSGMFa0umuq w7odP1Rntaf3zobBl+8VYPl8ziM66mQNeyJmYfdDSFyJDxwH08fYE1QU/eaJyKrp9uaniIiouqk aAnTfBwV6IYPQbeay5JpvNJ6VNcYyaO16zkmMkxyjeHRKn+wDtUTkm/11EZ8/yQHEAkel8SKA= X-Received: by 2002:adf:e004:0:20b0:460:2eee:4e21 with SMTP id ffacd0b85a97d-460302f0702mr3055000f8f.17.1780649549937; Fri, 05 Jun 2026 01:52:29 -0700 (PDT) Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4601f2dc412sm24595547f8f.4.2026.06.05.01.52.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 05 Jun 2026 01:52:29 -0700 (PDT) Date: Fri, 5 Jun 2026 09:52:28 +0100 From: David Laight To: Michael Bommarito Cc: Marcelo Ricardo Leitner , Xin Long , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Vlad Yasevich , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH net] sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Message-ID: <20260605095228.75430455@pumpkin> In-Reply-To: <20260604175803.2142975-1-michael.bommarito@gmail.com> References: <20260604175803.2142975-1-michael.bommarito@gmail.com> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 4 Jun 2026 13:58:03 -0400 Michael Bommarito wrote: > __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF > chunk can hold the ADDIP header and a parameter header, then calls > af->from_addr_param(), which reads the full address (16 bytes for IPv6) > trusting the parameter's declared length. > > An unauthenticated peer can send a truncated trailing ASCONF chunk that > declares an IPv6 address parameter but stops after the 4-byte parameter > header; reached from the no-association lookup path, from_addr_param() then > reads uninitialized bytes past the parameter. > > Impact: an unauthenticated SCTP peer makes the receive path read up to 16 > bytes of uninitialized memory past a truncated ASCONF address parameter. > > The sibling __sctp_rcv_init_lookup() bounds parameters with > sctp_walk_params(); this path open-codes the fetch and omits the bound. > Verify the whole address parameter lies within the chunk before > from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 > ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). > > Fixes: df2185771439 ("[SCTP]: Update association lookup to look at ASCONF chunks as well") > Assisted-by: Claude:claude-opus-4-8 > Signed-off-by: Michael Bommarito > --- > net/sctp/input.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > diff --git a/net/sctp/input.c b/net/sctp/input.c > --- a/net/sctp/input.c > +++ b/net/sctp/input.c > @@ -1196,6 +1196,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( > struct sctp_addip_chunk *asconf = (struct sctp_addip_chunk *)ch; > struct sctp_af *af; > union sctp_addr_param *param; > union sctp_addr paddr; > + __u16 plen; Just use 'unsigned int'. > > if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr)) > return NULL; It might be more obvious to check the 'free space' from the test above, say: int param_space = ntohs(ch->length); param_space -= sizeof(*asconf) + sizeof(struct sctp_paramhdr); if (param_space < 0) return NULL; param = (union sctp_addr_param *)(asconf + 1); if (ntohs(param->p.length) > param_space) return NULL; -- David > @@ -1204,6 +1205,16 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( > /* Skip over the ADDIP header and find the Address parameter */ > param = (union sctp_addr_param *)(asconf + 1); > > + /* The whole address parameter must lie within the chunk before > + * af->from_addr_param() reads the variable-length address; otherwise a > + * truncated trailing ASCONF chunk lets it read uninitialized bytes past > + * the parameter. Mirror the bound sctp_walk_params() applies on the > + * INIT path. > + */ > + plen = ntohs(param->p.length); > + if (plen < sizeof(struct sctp_paramhdr) || > + (u8 *)param + plen > (u8 *)ch + ntohs(ch->length)) > + return NULL; > + > af = sctp_get_af_specific(param_type2af(param->p.type)); > if (unlikely(!af)) > return NULL; >