From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D871B3EFFA8 for ; Fri, 10 Jul 2026 08:26:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783671968; cv=none; b=Q3rPO2AZJps0/wiugI9ElRkfIQ+llTEBMp5fWJ6lJCVpM2cKK38a/arN6/8Kp1ASx5gemNlPGElQD84HKf72c0ccvz82f19wZIvzKRYMktcrDxcEsw/gHw96u5XJscPzGT4/8RPUuJYzNdpLf4PQH8w4K6g/T49ID2fFRlnnPNM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783671968; c=relaxed/simple; bh=rhDkZKzNOPti8An0YJh9Wp82NZEV0D9oY3dxS79PLSk=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=oBYeAzqwAVvaS3GTdWa+ZAnqZQXTgelT7I7ID8ZGcmX8IKvAVhc2ZDDFqLNVGfn39bQePnCvZ6WnMpT7a1ccTYmpLKR2mTn8SQ5Q92hZ6RPCa19Xdrv3j8fbZu3Olih9zzZVdX6QXDC/3rUDxnvviiYHE3MK0KpoSuvStXrPruc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VqIRJa49; arc=none smtp.client-ip=209.85.221.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VqIRJa49" Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-4720f3bf164so876243f8f.1 for ; Fri, 10 Jul 2026 01:26:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783671964; x=1784276764; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=nUW4377iFNCldOqNyU33KDwovGokuGogAQ9Aa2VUBDI=; b=VqIRJa49QVWQHGXvuNfaplao0NPpTwtgRfAzNVmnOTPuzDyEnaV4dm6mT7HPQ3uXCp 8xHp/blEU2OI9v+GjZqdDu1gfH4UcgCj8XzYaP89cBXzR1fSXiuuIRQXhAz8Tl+IYpfq 1EDyyd8Z5RQNbcfVr1fsOLpo6dkqlVcN0KZH5DI+tOa9s5jDrRQmEdN/UCuPFjeB4Ffc Nywej0WzMssDHf+g3RuYF4e2RRnhSsbXGZAlOmW9GUZA0vyJ0bcXCegXwPxqzvYfb50Q Z5UIOWPNQ903yFeQfA8Z4Wj4f5Ca4tWW6XUULmE0aFPqcNYBeKefYyyqaWP/PAYspO+y y4Yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783671964; x=1784276764; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=nUW4377iFNCldOqNyU33KDwovGokuGogAQ9Aa2VUBDI=; b=T1A6Bc7TJ6T2ibQPlOcCJcSHdbs5vn8nVuQvGeCLHchZi+Yv5zXwts5EJ470zgzJ/+ rXoezioUDit7GFw5cLIhq7aaxgOkCSzIlguFmNissOFX79IwBko/PxgzGtkV3Eiz/YoP Kwl6bfMLdola9UXlvRoDBIhWD6JN8b+Uo9ebCfYlckEk+/+5hcHL2ykS1of3RLwCfUuI 3XKopDCG+bwCX4k9ytoMCCYrql0Pipq68NCcQy2LW9lCN2cM7QueCmaX363ZB6Vl9GgT 7y1z6IJFh42O4ogyvQAwrXRXV2a40kij9GN1WnudEdWwOXZH1Uqg6Z6D8QQfhtBopfFy wShA== X-Forwarded-Encrypted: i=1; AHgh+Rocjv7gZwUS+IPfQi7FKYzRJQHZqrfWW0Zkz8pp+udNR1N0Kj8bMGw7d/he6RfGr1Q6S+QNnZNXucmY6ZA=@vger.kernel.org X-Gm-Message-State: AOJu0YzXtvmjGrMmF/0LUdKZFLkngSIwJ/LXRNmFk953dRtk1kLHNmUG OFBynRm734DMy45xZyVqMjvY6dyOCbGT9JkZsLMhz9sAtePTsOvu0Uva X-Gm-Gg: AfdE7cnc/qKWrKijTbJZDZFLVkvqNQZ2IJTrWAnEWJkv94dbTEAZP8wg6qwPjA7YvWN dVZxARtWdkQWJ7oW7ep5X54BzamDApAf3H0Lwg7s07UHjW31IloRBBumXStHte+A2ZUbbYmQjbj irpKzbFD/e1YTIbnuWnxpa51SmSSnZ6fgYwD2VipHn3lqYW7mnA686RWCmc69qlVQyo63pflgwi CSBT/9Oy3BK9eUy8Gl/UXClC91ZjJPxzhGn4g6rbb2P9D/3r+2bZxDwRnOcbFM1Z8m4qo6LGC66 V1OuQ4c9Mp7DTUUYUmTPsvJ5FHSO7UdieX0+oK/qUjFgrLp1gQeYX6zs60A0jE+BYvgMYSmmit+ PPASpvKFwcGNRVnIt00nVfvYQIGSNTsR8BtUVUZxdZfIYBtbizoRFcKrcBTvIDxBTSLVHnMZTLv qHyO0Cw3BoO4hph1NFTuz6AuxxvGeJj8UaIL648yoBaCDuKQ== X-Received: by 2002:a05:6000:614:b0:47d:f681:b74a with SMTP id ffacd0b85a97d-47ef6990c8dmr2683692f8f.26.1783671963936; Fri, 10 Jul 2026 01:26:03 -0700 (PDT) Received: from pumpkin (host-92-21-50-228.as13285.net. [92.21.50.228]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47a9de1e736sm62016911f8f.7.2026.07.10.01.26.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 01:26:03 -0700 (PDT) Date: Fri, 10 Jul 2026 09:25:59 +0100 From: David Laight To: "Cen Zhang (Microsoft)" Cc: marcelo.leitner@gmail.com, lucien.xin@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, linux-sctp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com Subject: Re: [PATCH net v2] sctp: validate stream count in sctp_process_strreset_inreq() Message-ID: <20260710092559.40f37700@pumpkin> In-Reply-To: <20260710010718.20318-1-blbllhy@gmail.com> References: <20260710010718.20318-1-blbllhy@gmail.com> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 9 Jul 2026 21:07:18 -0400 "Cen Zhang (Microsoft)" wrote: > When processing a RESET_IN_REQUEST from a peer, > sctp_process_strreset_inreq() derives the stream count from the > parameter length but does not check whether the resulting > RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN. > > The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes > larger than the IN request header (sctp_strreset_inreq, 8 bytes). > Generally, the IP payload is bounded to 65535 bytes, so the stream > list cannot be large enough to trigger the overflow. However, on > interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a > stream list that fits within the incoming IN parameter can cause a > __u16 overflow in sctp_make_strreset_req() when computing the OUT > request size, leading to an undersized skb allocation and a kernel > BUG: > > net/core/skbuff.c:207 skb_panic > net/core/skbuff.c:2625 skb_put > net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk > net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req > net/sctp/stream.c:655 sctp_process_strreset_inreq > > The local setsockopt path validates the generated reset request size. > However, for an incoming-only reset, it accounts for the smaller IN > request even though the peer must generate an OUT request with the same > stream list. Such a request cannot be completed successfully by the > peer. > > Reject peer IN requests whose corresponding OUT request would exceed > SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an > IN request that would require an oversized OUT request from the peer. > > Fixes: 7f9d68ac944e ("sctp: implement sender-side procedures for SSN Reset Request Parameter") > Reported-by: AutonomousCodeSecurity@microsoft.com > Closes: https://lore.kernel.org/all/20260707203215.2752-1-blbllhy@gmail.com/ > Suggested-by: Xin Long > Signed-off-by: Cen Zhang (Microsoft) > --- > v2: Add the OUT request length check to the send path, as suggested by Xin Long. > > net/sctp/stream.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/net/sctp/stream.c b/net/sctp/stream.c > index 5c2fdedea088..34ffe6c945a4 100644 > --- a/net/sctp/stream.c > +++ b/net/sctp/stream.c > @@ -308,7 +308,8 @@ int sctp_send_reset_streams(struct sctp_association *asoc, > goto out; > > param_len += str_nums * sizeof(__u16) + > - sizeof(struct sctp_strreset_inreq); > + (out ? sizeof(struct sctp_strreset_inreq) > + : sizeof(struct sctp_strreset_outreq)); Does it really make any sense to have a connection with the 32k streams that would be needed in order to send a maximal length request? (Or more likely a user requesting the same streams be reset multiple times.) So an initial check that str_nums < SOME_CONSTANT_JUST_BELOW_32K would do. Looking at the code I'm sure the kmalloc() shouldn't be done in the 'str_nums == 0' case either. In fact it is probably worth doing the kmalloc() earlier to avoid two scans of the array. I even wonder if it should be possible to allocate the chunk without filling in the data and then put the values in afterwards (freeing the chunk if there is an error). Then there is the code that reverts the state to OPEN if sctp_send_reconf() fails - nothing check that is the original state. David > } > > if (param_len > SCTP_MAX_CHUNK_LEN - > @@ -639,6 +640,9 @@ struct sctp_chunk *sctp_process_strreset_inreq( > > nums = (ntohs(param.p->length) - sizeof(*inreq)) / sizeof(__u16); > str_p = inreq->list_of_streams; > + if (nums * sizeof(__u16) + sizeof(struct sctp_strreset_outreq) > > + SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_reconf_chunk)) > + goto out; > for (i = 0; i < nums; i++) { > if (ntohs(str_p[i]) >= stream->outcnt) { > result = SCTP_STRRESET_ERR_WRONG_SSN;