From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A2543ADBB4 for ; Wed, 15 Jul 2026 03:35:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784086558; cv=none; b=fdcGDtl8W/HTijiSFU/A7qCylQ0tRFx5GeW7rL5Gjia7SjHjwDfxVin92OADWIvRSk8alT1m5Ffxaj0nZihOwVKGyor5jmyNWv8anM1a8hxDCs43hX6cTBpuH4L8nTobYEEg9nzQ6Y4Q55vcWEht1vZVUTBzNJDnSmQRFNRCHo4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784086558; c=relaxed/simple; bh=tl9QUY60ANTH63SkBkkbYRa0mh0qVb/cgU5n6BRSkZs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=c/NaQ9TLc5Wbmvk4U+eq87eYalmzIjLYihntJ38IVCHJpck1/YlBZ6E9hUw1AUEIGacZtbpPZufPW5q4fRQYGDlfWj0TkrrrhAcV9Zc8Eo6QSmMA7sldxu/KIIBGtcMcAm9OJKEXusAXG1yK6gOueQC6clhpDorDrLM9PtuUOVU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=DNnqsjS/; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="DNnqsjS/" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2ca64c3ce5fso55652545ad.3 for ; Tue, 14 Jul 2026 20:35:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784086546; x=1784691346; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=ymvDeDodxFq3HgKKLyUeM3rErvPvsmK6UFUvd0diOrc=; b=DNnqsjS/SImdPVPfjMWu7EObi0d4fFvdi6Qh/LoBCMXyzl6EC2z9KefqXjWnBTBo/k 49qF5y4HmxaVTxTTsUnDB5CBWczBe9sl0fmax03fbyy1eGd8Wh49AvM5HgoOYXNbC4o4 bfQAqVsfoksuVfsPqg8SvDSRBlo2UxdqaVuPs6V4LjVhcnNYU+S/RjmwBTNlHCajx720 5cT+k/4qL+wt+37uCRMQq6+iQ6I9UlQ7YhCJReFrw7mT2xGGoWGRYBzNIJ9ewhodzSeu T/B4rZzBzPwxcKVOuHFtPJfBkT3btPaI4TmsBx40K9wJ4/Rw1gZ59kai9/+DHpMXVaPw dIDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784086546; x=1784691346; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ymvDeDodxFq3HgKKLyUeM3rErvPvsmK6UFUvd0diOrc=; b=CHMSJkrsVG0FXxI1JF5QDYDprREEenaP/wtWSY51ehMlyxTvCr1A3e9dfJDHA6B48p eAnV/f5Gx3WvUtSpBeVL/7Ya4gmOelVT5mxQVfEpkx/7fzTt4LRAhgnqP4i76OfWKhic FqqQEljaWBemcwIJIzQJgWDDMxTXPFizygYO4cIpHbfk3GRxnANRrHRrVdwICNacEts+ mV4i88fKPuTyTDVVEGWXCaW/ZhPG1sKrZZ8r1q5r72hlqsYre7Sruf65AlHjF1fqzeWa hJSvInU65jaM0CMP+lvJ9xzfTvepufKZybCmrEUVZIPL1JSJo8jQr9IAwFNTgLXJLPuJ n+3g== X-Forwarded-Encrypted: i=1; AHgh+RpD6/K0tvbfVuN7ltAjoOZLpiEYn7BKDyy+oTGKF9S9OhTr1QFBaza5/d8pVqu1N29SehtE6AAHkAp63Mw=@vger.kernel.org X-Gm-Message-State: AOJu0YydbGuFkSDqjIWqRnY8tSMMrYENQY3Atzr/NSoewSPpg7cvje01 MAZbb/qEZnLRjczbvzD4+QRgJYCyYIuJXy2QwgUrjzETMR2kLVnB6sxs X-Gm-Gg: AfdE7cmK8ZOoiy1COFsKgcIsIJN6F++MYQuKQxZNd2lhNBtf7y7eQoMaL7f9GtJDv6r nWGZlD1aF9GF375HgOeTcTduNQekPWNhjAIgoUxs2nZqNPt6gd9Zct7Kaui0shaSFy5PHlpyGgR Pdn17P02DJ6yeSYFqqgcz9VTgCv5e+RSod03lrC8JycLCspxtMB52mg26r5VGpdLxpjH1fWIyi+ JIUIIhpHhb0+xEsLWWaM6MoLPD0VNt9Qyh1Ka0YLtBMpaQf8ZWlphVoKkFtra9KGJ9T8iZFiaoy hWoGOhigRgtJSRfMynssekV2E0n88no5usuRtUqA1vJs4To4erEEOBF1GemEM6Blln55/U5AOuA YN0yHyq6T5znpzC+CEXUu2EFfFeiKpZG1RYi9U2y7VEte57qB9CIByRUEOttoGHJ1yT3zueUiOo VBcWXHPoxIg3c7KoXaX4DqAqv/hruBqNrp65ty2VfW7mZo X-Received: by 2002:a17:903:2a88:b0:2cc:5f9f:54ed with SMTP id d9443c01a7336-2cef12fe180mr53236485ad.27.1784086546202; Tue, 14 Jul 2026 20:35:46 -0700 (PDT) Received: from localhost.localdomain ([2404:2280:2000:8007:d87:748:d87:748]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9d3d451sm125464325ad.65.2026.07.14.20.35.41 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 14 Jul 2026 20:35:45 -0700 (PDT) From: MingXuan To: Marcelo Ricardo Leitner , Xin Long Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, MingXuan , stable@vger.kernel.org Subject: [PATCH] sctp: diag: fix uninitialized stack leak via INET_DIAG_LOCALS/PEERS Date: Wed, 15 Jul 2026 11:35:36 +0800 Message-ID: <20260715033536.64963-1-omeux327@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit inet_diag_msg_sctpladdrs_fill() copies sizeof(union sctp_addr) (28 bytes, the size of sockaddr_in6) from each sctp_sockaddr_entry.a into the netlink INET_DIAG_LOCALS attribute and then only zeroes the bytes from offset 28 to sizeof(sockaddr_storage). The same pattern is used by inet_diag_msg_sctpaddrs_fill() for INET_DIAG_PEERS. The IPv4 address-filling helpers sctp_v4_from_addr_param() and sctp_v4_from_skb() only initialize the sockaddr_in portion (16 bytes) of the union sctp_addr; the trailing 12 bytes (offset 16..27, the sockaddr_in6-only region) are left uninitialized. Those bytes are propagated verbatim through sctp_add_bind_addr() (which copies sizeof(union sctp_addr)=28 bytes) and then copied straight to userspace by the diag fill functions, leaking 12 bytes of kernel stack residue per local/peer address to any process that can issue a SOCK_DIAG_BY_FAMILY dump for IPPROTO_SCTP. Fix it by computing the actually-initialized length of the address from its sa_family (struct sockaddr_in for AF_INET, the whole union otherwise) and copying only that many bytes into an already-zeroed sockaddr_storage slot, so the uninitialized tail is never read and never reaches userspace. Fixes: 8f840e47f190cbe61a96945c13e9551048d42cef ("sctp: add the sctp_diag.c file") Cc: stable@vger.kernel.org Signed-off-by: MingXuan --- net/sctp/diag.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/net/sctp/diag.c b/net/sctp/diag.c index d758f5c3e06e..12557e924cc2 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -85,8 +85,12 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb, info = nla_data(attr); rcu_read_lock(); list_for_each_entry_rcu(laddr, address_list, list) { - memcpy(info, &laddr->a, sizeof(laddr->a)); - memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a)); + size_t addr_len = laddr->a.sa.sa_family == AF_INET ? + sizeof(struct sockaddr_in) : + sizeof(struct sockaddr_in6); + + memset(info, 0, addrlen); + memcpy(info, &laddr->a, addr_len); info += addrlen; if (!--addrcnt) @@ -113,9 +117,12 @@ static int inet_diag_msg_sctpaddrs_fill(struct sk_buff *skb, info = nla_data(attr); list_for_each_entry(from, &asoc->peer.transport_addr_list, transports) { - memcpy(info, &from->ipaddr, sizeof(from->ipaddr)); - memset(info + sizeof(from->ipaddr), 0, - addrlen - sizeof(from->ipaddr)); + size_t addr_len = from->ipaddr.sa.sa_family == AF_INET ? + sizeof(struct sockaddr_in) : + sizeof(struct sockaddr_in6); + + memset(info, 0, addrlen); + memcpy(info, &from->ipaddr, addr_len); info += addrlen; } -- 2.50.1 (Apple Git-155)