From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D79FC3EC83E for ; Thu, 13 Aug 2026 19:05:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786647957; cv=none; b=Sscj5Qbdo0QNfCQK4ygJjtjmrScbVqWKmUIZmESt0E8zqS7CzIFs2xWdvIGeuX3TWcaG83zvXy5nRWyTir18v67aKsreZ1NpD4q6zNxJLU9cdRyZUzTOpSat6kmYiQzsOsGkXX47AuR/TyoXxBK9e2xF+lNvlbvKBlfGk2wzVhY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786647957; c=relaxed/simple; bh=B2bnMqNqoYYuTkMqtL6g4MAmG3rWQieX91fm8hm4Sf8=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=B2/PtiJxucmRfi/8nkkM+SAyS/Sk7Eu1ft8sepuNAoF4zJvU7ihVFwzVcLOSRJT/HUZzFWSPZ0eNsIaVCdWzexwGrbYd9hDVCfrbmdFgM4Ewu9uf2+F3WeGumeHoTQbBOADAi02RGmhC4AsUDU7uk6xPfKCJd+mUazU1PXecUf0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UZm3+gwk; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UZm3+gwk" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-47f703a9d05so136360f8f.0 for ; Thu, 13 Aug 2026 12:05:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786647954; x=1787252754; darn=vger.kernel.org; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=T55vEoBWm7W+mkApMI66CBUWbz2M2GmccHPPbYJGC5s=; b=UZm3+gwkDUE+BUz+09A+anYAB0gDPcnXKmgMalwlBr5Dcwzr66w6LDLWYGRyE2Xuob r/F5G8eZAMCX0EJCKtJ9WrTR0XVuB/YZgWFBdvV9vbrqgQBkYGg+EKZPYuLREwnpMeXt M6znZmlywAkURdnsJKuE/Q/vSlG9EmHuBLqYoSGS8INh0yN54lVf+jWWLOS6mNZioAX0 /YM9iuDfnW5cR+sf+KQ2c4LZZc2kKjnEkNRhlzWzhSch2EvBRkkhuNE2CqoyFXZgbJxZ xR4Yg4xtzaAWFdu8p4J4tA2yqyzFq1NRLu89Y9sarVJOEKwwBw9tlzJshOxBOuPmdPgB huMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786647954; x=1787252754; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=T55vEoBWm7W+mkApMI66CBUWbz2M2GmccHPPbYJGC5s=; b=Oskji3qCUNPTccbdNN4gclvVGrCoDBp3z8hI60c8Of4z+zTyfeOqzN42A//RLyPhp9 ns12DdCGpC2xOeOo53LdaRrVYq1I8hMMzUPtJPP+/wA9pqNN7Ll5h/WrMfM20/QubR9R +F1l/Y8eHRkQAwAtuexrOEEBUtWsFZ1XcTrwy5xrsdDwWyKkSrAhMKtYXw/57DrdgltY naZtl8uCw8E0ndo///KYURBaUanSN0Oyj9SjFcfmG18bQ/nrqjPSABJzG3TjJI9p0gyb OoAGdovo61dwpN6nzdcQXAjP/JWWl4H88oibcH6Bq/y7SmwCB7Yy4mSzagU75merrKUn YV5Q== X-Forwarded-Encrypted: i=1; AHgh+Ro2YjrGl/riZLl8YGot9HxbBjbDfeIPeZMlCkHc2EmkxZYPDZE8r0Sy0hVZLYc8bDIShZ8o/PRTHmEsV8Y=@vger.kernel.org X-Gm-Message-State: AOJu0YwQEJXtsMHzqpq5vSqrOehbwc6NMRo0kBa8hYSJv7dy3uzajE97 +E9la2zvQDz/LuhP9Y7I+QonnW779C3kn9GVwldl9N8FMMJZaiPNw7/r X-Gm-Gg: AR+sD1067ZCXyK9gbf1frWfP6//RAKLsefH9IL8T2dkEyf0R8GCzU4hcu22SUAfgfxp 911vBtLquiKtdNnvUtUS+yfJjVzORsFSzaHxyVd8fvWiCs3uxs+Xepp1Sef0CNznPkfOXVoTh7P +exYZKWF6FU58CTrKiA9RMCDV4L07CtYhUHrf3ZsXL1kZHUDer4j9OPMUfGDvCOSeJRdcf2paGh 8H365W9grz7x7CrmkKMTOmLP03O3BIw4n0069poUKSjSqiQGjuDYd7ieWtSxEqsZgHkzJ0eStLt jLTBGSAYfL1gQlMAc6t8PCOektadlCtzaaTU2M2D6GA2eeTT6X1uxNxzhOaTojp+O1vo/M82CtF 4yGm6MUDAxWP+EKmu1q6ZVnn06Cpm9C2es8pyUYTEE9uVJnfij5O0EStw4O03uDhVdxb2ZGOXfc a9Qt72h/0hj4s/uKrZQdBAQy/7UlLZbn6WMNjNI4zubBhoKqPZr/ZKIdBF X-Received: by 2002:a5d:588b:0:b0:481:4fe8:696b with SMTP id ffacd0b85a97d-481607ba630mr387086f8f.29.1786647954032; Thu, 13 Aug 2026 12:05:54 -0700 (PDT) Received: from localhost ([2c0f:3d00:6be:8900:ce5e:9212:ea4b:f30]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4815f2b1d9bsm1382077f8f.24.2026.08.13.12.05.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 12:05:53 -0700 (PDT) Date: Thu, 13 Aug 2026 22:05:49 +0300 From: Dan Carpenter To: oe-kbuild@lists.linux.dev, Michael Bommarito Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org, Jakub Kicinski Subject: net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max' Message-ID: <202608140244.f2Omwf4y-lkp@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 3d6d817622b0a9721e3cc404df3469171582be13 commit: 0cf004ffb61cd32d140531c3a84afe975f9fc7ea sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks config: m68k-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260814/202608140244.f2Omwf4y-lkp@intel.com/config) compiler: m68k-linux-gcc (GCC) 10.5.0 smatch: v0.5.0-9187-g5189e3fb If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Fixes: 0cf004ffb61c ("sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks") | Reported-by: kernel test robot | Reported-by: Dan Carpenter | Closes: https://lore.kernel.org/r/202608140244.f2Omwf4y-lkp@intel.com/ New smatch warnings: net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max' Old smatch warnings: net/sctp/socket.c:7042 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max' net/sctp/socket.c:7086 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max' net/sctp/socket.c:7092 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max' net/sctp/socket.c:9018 sctp_wait_for_packet() warn: missing error code 'error' vim +7036 net/sctp/socket.c 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7006 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7007 char __user *optval, int __user *optlen) 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7008 { 411223c01a5116 Al Viro 2007-10-14 7009 struct sctp_authchunks __user *p = (void __user *)optval; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7010 struct sctp_authchunks val; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7011 struct sctp_association *asoc; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7012 struct sctp_chunks_param *ch; 5e739d1752aca4 Vlad Yasevich 2008-08-21 7013 u32 num_chunks = 0; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7014 char __user *to; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7015 5e739d1752aca4 Vlad Yasevich 2008-08-21 7016 if (len < sizeof(struct sctp_authchunks)) 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7017 return -EINVAL; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7018 c76f97c99ae6d2 Marcelo Ricardo Leitner 2018-01-08 7019 if (copy_from_user(&val, optval, sizeof(val))) 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7020 return -EFAULT; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7021 411223c01a5116 Al Viro 2007-10-14 7022 to = p->gauth_chunks; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7023 asoc = sctp_id2assoc(sk, val.gauth_assoc_id); 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7024 if (!asoc) 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7025 return -EINVAL; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7026 219f9ea4d3b797 Xin Long 2019-08-19 7027 if (!asoc->peer.auth_capable) 219f9ea4d3b797 Xin Long 2019-08-19 7028 return -EACCES; 219f9ea4d3b797 Xin Long 2019-08-19 7029 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7030 ch = asoc->peer.peer_chunks; 5e739d1752aca4 Vlad Yasevich 2008-08-21 7031 if (!ch) 5e739d1752aca4 Vlad Yasevich 2008-08-21 7032 goto num; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7033 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7034 /* See if the user provided enough room for all the data */ 3c918704921412 Xin Long 2017-06-30 7035 num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr); 0cf004ffb61cd3 Michael Bommarito 2026-04-15 @7036 if (len < sizeof(struct sctp_authchunks) + num_chunks) This is a m68k-linux-gcc build (32 bits). sizeof(struct sctp_paramhdr) is 4 and sizeof(struct sctp_authchunks) is 8 so on a 32bit system if num_chunks U32_MAX - 4 then the "sizeof(struct sctp_authchunks) + num_chunks" math could overflow. 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7037 return -EINVAL; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7038 5e739d1752aca4 Vlad Yasevich 2008-08-21 7039 if (copy_to_user(to, ch->chunks, num_chunks)) It doesn't really cause a problem these days because copy_to_user() doesn't accept sizes more than INT_MAX but it would trigger a warning. 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7040 return -EFAULT; 5e739d1752aca4 Vlad Yasevich 2008-08-21 7041 num: 5e739d1752aca4 Vlad Yasevich 2008-08-21 7042 len = sizeof(struct sctp_authchunks) + num_chunks; 8d72651d86e9c7 wangweidong 2013-12-23 7043 if (put_user(len, optlen)) 8d72651d86e9c7 wangweidong 2013-12-23 7044 return -EFAULT; 7e8616d8e7731b Vlad Yasevich 2008-02-27 7045 if (put_user(num_chunks, &p->gauth_number_of_chunks)) 7e8616d8e7731b Vlad Yasevich 2008-02-27 7046 return -EFAULT; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7047 return 0; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7048 } -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki