Forwarded: [PATCH] net: sctp: linearize cloned gso packets in sctp_rcv

[syzbot <syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] net: sctp: linearize cloned gso packets in sctp_rcv
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


Fix a kernel panic bug caused by an unexpected layout geometry mismatch
when flattening cloned non-linear SCTP GSO packets.

When an incoming packet is cloned (e.g., during packet capturing via
tcpdump or Wireshark), sctp_rcv() must flatten the packet into a single,
continuous memory block before parsing its chunks. However, if the packet's
internal frag_list has tracking discrepancies, calling downstream memory
handlers like __pskb_pull_tail() triggers an operational failure.
Because the kernel treats this failure as an invariant violation, it
executes a fatal BUG_ON() assertion, resulting in a system-wide panic.

Fix this issue by validating memory linearization early in sctp_rcv().
By intercepting non-zero return codes from skb_linearize(), the kernel
can detect frag_list length discrepancies before they reach the core
network buffer handlers, allowing malformed packets to be safely routed
to the discard routine rather than crashing the operating system.

Reported-by: syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f15a6eff7a53f6eb7dc3
Fixes: 90017accff61 ("sctp: support GSO")
Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>
---
 net/sctp/input.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 9494cfa51106..6f66ae656d70 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -116,8 +116,13 @@ int sctp_rcv(struct sk_buff *skb)
 	/* If the packet is fragmented and we need to do crc checking,
 	 * it's better to just linearize it otherwise crc computing
 	 * takes longer.
+	 *
+	 * If there is a geometry mismatch, length discrepancy, or offset corruption
+	 * in the packet, skb_linearize will fail and return
+	 * a non-zero error code.
 	 */
-	if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb)) ||
+
+	if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb) != 0) ||
 	    !pskb_may_pull(skb, sizeof(struct sctphdr)))
 		goto discard_it;
 
-- 
2.56.0