From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
Date: Fri, 14 Aug 2026 02:08:20 +0800 [thread overview]
Message-ID: <202608140244.f2Omwf4y-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Michael Bommarito <michael.bommarito@gmail.com>
CC: Jakub Kicinski <kuba@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 3d6d817622b0a9721e3cc404df3469171582be13
commit: 0cf004ffb61cd32d140531c3a84afe975f9fc7ea sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
date: 4 months ago
:::::: branch date: 27 hours ago
:::::: commit date: 4 months ago
config: m68k-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260814/202608140244.f2Omwf4y-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 10.5.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 0cf004ffb61c ("sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608140244.f2Omwf4y-lkp@intel.com/
New smatch warnings:
net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
Old smatch warnings:
net/sctp/socket.c:7042 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:7086 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:7092 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:9018 sctp_wait_for_packet() warn: missing error code 'error'
vim +7036 net/sctp/socket.c
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7005
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7006 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7007 char __user *optval, int __user *optlen)
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7008 {
411223c01a5116 Al Viro 2007-10-14 7009 struct sctp_authchunks __user *p = (void __user *)optval;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7010 struct sctp_authchunks val;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7011 struct sctp_association *asoc;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7012 struct sctp_chunks_param *ch;
5e739d1752aca4 Vlad Yasevich 2008-08-21 7013 u32 num_chunks = 0;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7014 char __user *to;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7015
5e739d1752aca4 Vlad Yasevich 2008-08-21 7016 if (len < sizeof(struct sctp_authchunks))
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7017 return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7018
c76f97c99ae6d2 Marcelo Ricardo Leitner 2018-01-08 7019 if (copy_from_user(&val, optval, sizeof(val)))
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7020 return -EFAULT;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7021
411223c01a5116 Al Viro 2007-10-14 7022 to = p->gauth_chunks;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7023 asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7024 if (!asoc)
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7025 return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7026
219f9ea4d3b797 Xin Long 2019-08-19 7027 if (!asoc->peer.auth_capable)
219f9ea4d3b797 Xin Long 2019-08-19 7028 return -EACCES;
219f9ea4d3b797 Xin Long 2019-08-19 7029
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7030 ch = asoc->peer.peer_chunks;
5e739d1752aca4 Vlad Yasevich 2008-08-21 7031 if (!ch)
5e739d1752aca4 Vlad Yasevich 2008-08-21 7032 goto num;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7033
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7034 /* See if the user provided enough room for all the data */
3c918704921412 Xin Long 2017-06-30 7035 num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);
0cf004ffb61cd3 Michael Bommarito 2026-04-15 @7036 if (len < sizeof(struct sctp_authchunks) + num_chunks)
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7037 return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7038
5e739d1752aca4 Vlad Yasevich 2008-08-21 7039 if (copy_to_user(to, ch->chunks, num_chunks))
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7040 return -EFAULT;
5e739d1752aca4 Vlad Yasevich 2008-08-21 7041 num:
5e739d1752aca4 Vlad Yasevich 2008-08-21 7042 len = sizeof(struct sctp_authchunks) + num_chunks;
8d72651d86e9c7 wangweidong 2013-12-23 7043 if (put_user(len, optlen))
8d72651d86e9c7 wangweidong 2013-12-23 7044 return -EFAULT;
7e8616d8e7731b Vlad Yasevich 2008-02-27 7045 if (put_user(num_chunks, &p->gauth_number_of_chunks))
7e8616d8e7731b Vlad Yasevich 2008-02-27 7046 return -EFAULT;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7047 return 0;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7048 }
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7049
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev,
Michael Bommarito <michael.bommarito@gmail.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-kernel@vger.kernel.org, Jakub Kicinski <kuba@kernel.org>
Subject: net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
Date: Thu, 13 Aug 2026 22:05:49 +0300 [thread overview]
Message-ID: <202608140244.f2Omwf4y-lkp@intel.com> (raw)
Message-ID: <20260813190549.GaFwNDghxDEGfxYnhRYjV2HybD92-3uvAnWvxKrEpO8@z> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 3d6d817622b0a9721e3cc404df3469171582be13
commit: 0cf004ffb61cd32d140531c3a84afe975f9fc7ea sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
config: m68k-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260814/202608140244.f2Omwf4y-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 10.5.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 0cf004ffb61c ("sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608140244.f2Omwf4y-lkp@intel.com/
New smatch warnings:
net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
Old smatch warnings:
net/sctp/socket.c:7042 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:7086 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:7092 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:9018 sctp_wait_for_packet() warn: missing error code 'error'
vim +7036 net/sctp/socket.c
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7006 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7007 char __user *optval, int __user *optlen)
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7008 {
411223c01a5116 Al Viro 2007-10-14 7009 struct sctp_authchunks __user *p = (void __user *)optval;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7010 struct sctp_authchunks val;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7011 struct sctp_association *asoc;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7012 struct sctp_chunks_param *ch;
5e739d1752aca4 Vlad Yasevich 2008-08-21 7013 u32 num_chunks = 0;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7014 char __user *to;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7015
5e739d1752aca4 Vlad Yasevich 2008-08-21 7016 if (len < sizeof(struct sctp_authchunks))
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7017 return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7018
c76f97c99ae6d2 Marcelo Ricardo Leitner 2018-01-08 7019 if (copy_from_user(&val, optval, sizeof(val)))
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7020 return -EFAULT;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7021
411223c01a5116 Al Viro 2007-10-14 7022 to = p->gauth_chunks;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7023 asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7024 if (!asoc)
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7025 return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7026
219f9ea4d3b797 Xin Long 2019-08-19 7027 if (!asoc->peer.auth_capable)
219f9ea4d3b797 Xin Long 2019-08-19 7028 return -EACCES;
219f9ea4d3b797 Xin Long 2019-08-19 7029
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7030 ch = asoc->peer.peer_chunks;
5e739d1752aca4 Vlad Yasevich 2008-08-21 7031 if (!ch)
5e739d1752aca4 Vlad Yasevich 2008-08-21 7032 goto num;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7033
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7034 /* See if the user provided enough room for all the data */
3c918704921412 Xin Long 2017-06-30 7035 num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);
0cf004ffb61cd3 Michael Bommarito 2026-04-15 @7036 if (len < sizeof(struct sctp_authchunks) + num_chunks)
This is a m68k-linux-gcc build (32 bits). sizeof(struct sctp_paramhdr)
is 4 and sizeof(struct sctp_authchunks) is 8 so on a 32bit system if
num_chunks U32_MAX - 4 then the "sizeof(struct sctp_authchunks) +
num_chunks" math could overflow.
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7037 return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7038
5e739d1752aca4 Vlad Yasevich 2008-08-21 7039 if (copy_to_user(to, ch->chunks, num_chunks))
It doesn't really cause a problem these days because copy_to_user()
doesn't accept sizes more than INT_MAX but it would trigger a warning.
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7040 return -EFAULT;
5e739d1752aca4 Vlad Yasevich 2008-08-21 7041 num:
5e739d1752aca4 Vlad Yasevich 2008-08-21 7042 len = sizeof(struct sctp_authchunks) + num_chunks;
8d72651d86e9c7 wangweidong 2013-12-23 7043 if (put_user(len, optlen))
8d72651d86e9c7 wangweidong 2013-12-23 7044 return -EFAULT;
7e8616d8e7731b Vlad Yasevich 2008-02-27 7045 if (put_user(num_chunks, &p->gauth_number_of_chunks))
7e8616d8e7731b Vlad Yasevich 2008-02-27 7046 return -EFAULT;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7047 return 0;
65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7048 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-08-13 18:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-13 18:08 kernel test robot [this message]
2026-08-13 19:05 ` net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max' Dan Carpenter
2026-08-13 20:21 ` Michael Bommarito
-- strict thread matches above, loose matches on Subject: below --
2026-05-02 22:09 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202608140244.f2Omwf4y-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.