Re: Subject: [SECURITY] sctp: diag: uninit kernel stack leak via INET_DIAG_LOCALS/PEERS

Re: Subject: [SECURITY] sctp: diag: uninit kernel stack leak via INET_DIAG_LOCALS/PEERS

[Greg KH]

On Tue, Jul 14, 2026 at 02:19:00PM +0800, omeux wrote:
> 5. Suggested fix
> ---------------------------------------------------------------
>    - Suspected location: net/sctp/diag.c inet_diag_msg_sctpladdrs_fill()
>      and inet_diag_msg_sctpaddrs_fill(); the uninit source is in
>      net/sctp/protocol.c sctp_v4_from_skb()/sctp_v4_from_addr_param().
>    - Proposed and tested fix: zero the full sockaddr_storage slot first,
>      then copy only the actually-initialized length of the address
>      (sizeof(struct sockaddr_in) for AF_INET, sizeof(union sctp_addr)
>      otherwise) so the uninitialized tail never reaches userspace.
> 
>        Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
>        Cc: stable@vger.kernel.org
>        Signed-off-by: Your Name <you@example.com>

Please turn this into a patch that can be applied, and properly use your
name and the Assisted-by: tag showing that you used an LLM for this
thing, so that it can be considered as a real patch.

Also, when cc:ing a public mailing list, no need to get
security@kernel.org involved.

thanks,

greg k-h