From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B12773B14CF for ; Wed, 15 Jul 2026 16:15:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.210.176 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784132157; cv=pass; b=CMiEAHTF1ss2ab3e2gyiQSC/b1Gi09ArHXNcxIw6h1B9znKXyNdy/Ywh0fAs+/YTgEsi2/U3D8oHBKGCXYe2JzHNpzCvfXw2f8IX24Y1SUkteaxfGWKFiQlssSMIu4LoPkA7yR+7B6JkDzFWgdG/4yvU86wghk2LlHqV1QnSd6M= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784132157; c=relaxed/simple; bh=FWxiQlTdycZ3hlyFTtfVocuTp0ZAD9+zUnnyMVWM3YA=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=am/DWyi0mW4E2pPQ6BmTbngmidz+iYidTiPWQv4TbUBXaMvIpqUYgiMDlePz1rgo9Ba1dgIomgJ8udQSMwWLM0IWOnE3pf6iiZzIDN6xVlmefFcSLs5cOTrKxEldSoo2BopqnPZGgZAyy9tMMx9bkfdu7dhiK7zZVMXwtKD6wAk= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gJkCsuZ5; arc=pass smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gJkCsuZ5" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-8484f229529so1711768b3a.2 for ; Wed, 15 Jul 2026 09:15:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784132153; cv=none; d=google.com; s=arc-20260327; b=awbXxj6SM3KiYhqfUP/c2triHwdv62vh3LDpg7w+Z4AA7YjAQ4G2iJpoizXVCBrytp TnyNrceYeijAhHXBXC6RKvBrWYAMSzl4nNqOlNxYP3eawCN5OPUiQxVF9jim7fUjDPla N4Ll3nXAnCe6gBhU33D+Uh+nrBuClSiyqDmOjUvzRVQMKZEPvpV1CQau+O3bs5D2idwm QbTIkSOgqUWlyJIby4fu2/t6LDQu5VcdFmpQPPtZmVgod8apdwdZpK6espcWwKEe3Enw 9lrcsImXWTSnk0nq+apvvHdHx+Z2qKVgVM+afzLupTNof3xfIqWqT7UloBZXtS1l+Tb7 8phw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=55U5jPSUwP069w7ruvqo1At+jwtU2ebGa6t3Zfz+ez0=; fh=Y5Oh6JfOzurco3O1JBZUy8LgbYcaOvnSZdgwJvlDQzQ=; b=gPlm95rXL0L6Z5tjr4HwIQ8T3/xUrHX73laflqOJ2KrplXoIDUCsyLkG2CPlbEPrB6 P0ic3WoONVM8DHcJwiusgkod9FGTwGoxqPmy+x0eEEUQdq+DYi3jUAZwgdQ/rQcs09gD IlQ502dDuyVbqlgWbvTtzwWPhGmQNRYXsmMy3AX9+XcW0HDVJkKCh5hLc50SB2syfSTi aXJ1CeLVa9mtx3yBcE5am2kwtp//56AM+In519Cn32A/x6NOXMeammiFVMkEtc/ypdZW 0h1Pn8FqlJM6CuL4RLFmXX22WkcARwDWRsv5rpoRxDmPnmY5iyDZBtxkWzgB1Oy5xyVK inRw==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784132153; x=1784736953; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=55U5jPSUwP069w7ruvqo1At+jwtU2ebGa6t3Zfz+ez0=; b=gJkCsuZ5UQVwFiaMjQHDwxGR11gsOHa8WB+CZdbI5DxcyZUWGLC2oUllK/RAyajXQz 7Rsn3mRu3MxwEXIzjklOlkPHEuxqYmfKzl7TCp+UHNHSr49OUXtE6UBN7GerfWa5PgCg E0PAPA6sqPxbo/lg8ygU6bXyG06906yuoORwfzTpY6bPUc+w59QPRefinlTPCuYc1d+p 6/2HOwYc6gcixegPEaZLsVUqUyKz6BX+VqP3q4j9wxA+YRSjlQSlwmYXnUZ8VKkXNUq6 4xAeS7znJdgwoJMr6AA3M+kBktQSktWidp5ohAvUnR131kHyv3vRizpZ8MFUP7Zbk3ac pI6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784132153; x=1784736953; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=55U5jPSUwP069w7ruvqo1At+jwtU2ebGa6t3Zfz+ez0=; b=ZfC7tjSK91qBH/uu5q5cECt8CDz/4qXjyBaebf8xrRAD6HNWb7hHyDorBaA8DBBI3V l0B3XjN9xei08jvtXWu4xvZdnKXMkCHtoakV5xv7j+czX9Cp+cbVQpBBFXXmpYHWULNP hi4yYDaHGPppUekXSjvhYByVQo6vh4ZYfXmQt+bbQUeMjSVx7NdL2JEwTCoY58O7E5U+ iEbPe/criSAUdIrU8TLxBX7JyWsr6yabJ60gB4ojkFTI5SotMXBjZX6ywNpTdbZG9M3N 320rhkBr5HvX7F2+scsb3BZSp/W7qp+CLt1csswHxW2IYWKjk65idFEVN6FLWppCABBl bQCQ== X-Forwarded-Encrypted: i=1; AHgh+Ro/xXzovtSVlKK2WYxs4WmYO3QZlu81sfYWCzq8e3r7lr8PeU5tHpS29up59CICxBYFaNun1ftuu2XyKhk=@vger.kernel.org X-Gm-Message-State: AOJu0YyTI8Jux2WsLGUbp4bOnnRoNA1bJ3ahlMB3T1yT+nytVMGJYkG8 igoqmxYW3OWkIJlQ3BBZTUUTDK+h33zcLuLx/iB1pFbxntS26KtJh42IR62HISi4UU8Y+IaqLDD 6rmnQxqE4AEltxvde03tBnT8n9B4nvTo= X-Gm-Gg: AfdE7ckex7xkOPrp9eCXpjIbJ2knAAPh4oRLU+U302Fb5n9+yPPPADTlVK2WZJYA1FN eGzKIT7gmy+IxriXHVOXq2ISXCqBrTUQQWZfQ/iUfiIK+W40yef3DvpqBGrc6abDc3/KNZXm4Tv yvvqB6OlTfCjnH6khY9RJfMYBTgmIkC44+9XONohAsa7J73nru69I4jJgLK7VjBkpnHVUbAiYfs etYd9T8EjGUyU/7I66SHGkSO3aP21YpOSSXuFyfBMSGKDcPXoBmpWDg/fgs9HmuplSQDH79lOUY xOOOHw+gWVGBIpxQOL6U/r0t/4ai1JxUOW0qQctBC4beB7S9wlWoRb9wdPfvqG47EDUB+44R X-Received: by 2002:a05:6a00:27a5:b0:847:99bb:b6d0 with SMTP id d2e1a72fcca58-848896bf0bbmr16582991b3a.15.1784132153108; Wed, 15 Jul 2026 09:15:53 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260715033536.64963-1-omeux327@gmail.com> In-Reply-To: <20260715033536.64963-1-omeux327@gmail.com> From: Xin Long Date: Wed, 15 Jul 2026 12:15:40 -0400 X-Gm-Features: AUfX_mxyqRaNfNT_XTqID_5ulkJvqsCBG2mC6ONt8peeaiBkWktmOsu9fvIkJOc Message-ID: Subject: Re: [PATCH] sctp: diag: fix uninitialized stack leak via INET_DIAG_LOCALS/PEERS To: MingXuan Cc: Marcelo Ricardo Leitner , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 14, 2026 at 11:35=E2=80=AFPM MingXuan wrot= e: > > inet_diag_msg_sctpladdrs_fill() copies sizeof(union sctp_addr) (28 bytes, > the size of sockaddr_in6) from each sctp_sockaddr_entry.a into the netlin= k > INET_DIAG_LOCALS attribute and then only zeroes the bytes from offset 28 = to > sizeof(sockaddr_storage). The same pattern is used by > inet_diag_msg_sctpaddrs_fill() for INET_DIAG_PEERS. > > The IPv4 address-filling helpers sctp_v4_from_addr_param() and > sctp_v4_from_skb() only initialize the sockaddr_in portion (16 bytes) of = the > union sctp_addr; the trailing 12 bytes (offset 16..27, the sockaddr_in6-o= nly > region) are left uninitialized. Those bytes are propagated verbatim thro= ugh > sctp_add_bind_addr() (which copies sizeof(union sctp_addr)=3D28 bytes) an= d then > copied straight to userspace by the diag fill functions, leaking 12 bytes= of > kernel stack residue per local/peer address to any process that can issue= a > SOCK_DIAG_BY_FAMILY dump for IPPROTO_SCTP. > > Fix it by computing the actually-initialized length of the address from i= ts > sa_family (struct sockaddr_in for AF_INET, the whole union otherwise) and > copying only that many bytes into an already-zeroed sockaddr_storage slot= , so > the uninitialized tail is never read and never reaches userspace. > > Fixes: 8f840e47f190cbe61a96945c13e9551048d42cef ("sctp: add the sctp_diag= .c file") > Cc: stable@vger.kernel.org > Signed-off-by: MingXuan > --- > net/sctp/diag.c | 17 ++++++++++++----- > 1 file changed, 12 insertions(+), 5 deletions(-) > > diff --git a/net/sctp/diag.c b/net/sctp/diag.c > index d758f5c3e06e..12557e924cc2 100644 > --- a/net/sctp/diag.c > +++ b/net/sctp/diag.c > @@ -85,8 +85,12 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buf= f *skb, > info =3D nla_data(attr); > rcu_read_lock(); > list_for_each_entry_rcu(laddr, address_list, list) { > - memcpy(info, &laddr->a, sizeof(laddr->a)); > - memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr= ->a)); > + size_t addr_len =3D laddr->a.sa.sa_family =3D=3D AF_INET = ? > + sizeof(struct sockaddr_in) : > + sizeof(struct sockaddr_in6); > + > + memset(info, 0, addrlen); > + memcpy(info, &laddr->a, addr_len); > info +=3D addrlen; > > if (!--addrcnt) > @@ -113,9 +117,12 @@ static int inet_diag_msg_sctpaddrs_fill(struct sk_bu= ff *skb, > info =3D nla_data(attr); > list_for_each_entry(from, &asoc->peer.transport_addr_list, > transports) { > - memcpy(info, &from->ipaddr, sizeof(from->ipaddr)); > - memset(info + sizeof(from->ipaddr), 0, > - addrlen - sizeof(from->ipaddr)); > + size_t addr_len =3D from->ipaddr.sa.sa_family =3D=3D AF_I= NET ? > + sizeof(struct sockaddr_in) : > + sizeof(struct sockaddr_in6); > + > + memset(info, 0, addrlen); > + memcpy(info, &from->ipaddr, addr_len); > info +=3D addrlen; > } > > -- > 2.50.1 (Apple Git-155) > Acked-by: Xin Long