net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'

[Dan Carpenter <error27@gmail.com>]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   3d6d817622b0a9721e3cc404df3469171582be13
commit: 0cf004ffb61cd32d140531c3a84afe975f9fc7ea sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
config: m68k-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260814/202608140244.f2Omwf4y-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 10.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 0cf004ffb61c ("sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608140244.f2Omwf4y-lkp@intel.com/

New smatch warnings:
net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'

Old smatch warnings:
net/sctp/socket.c:7042 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:7086 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:7092 sctp_getsockopt_local_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'
net/sctp/socket.c:9018 sctp_wait_for_packet() warn: missing error code 'error'

vim +7036 net/sctp/socket.c

65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7006  static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7007  				    char __user *optval, int __user *optlen)
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7008  {
411223c01a5116 Al Viro                 2007-10-14  7009  	struct sctp_authchunks __user *p = (void __user *)optval;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7010  	struct sctp_authchunks val;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7011  	struct sctp_association *asoc;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7012  	struct sctp_chunks_param *ch;
5e739d1752aca4 Vlad Yasevich           2008-08-21  7013  	u32    num_chunks = 0;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7014  	char __user *to;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7015  
5e739d1752aca4 Vlad Yasevich           2008-08-21  7016  	if (len < sizeof(struct sctp_authchunks))
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7017  		return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7018  
c76f97c99ae6d2 Marcelo Ricardo Leitner 2018-01-08  7019  	if (copy_from_user(&val, optval, sizeof(val)))
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7020  		return -EFAULT;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7021  
411223c01a5116 Al Viro                 2007-10-14  7022  	to = p->gauth_chunks;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7023  	asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7024  	if (!asoc)
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7025  		return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7026  
219f9ea4d3b797 Xin Long                2019-08-19  7027  	if (!asoc->peer.auth_capable)
219f9ea4d3b797 Xin Long                2019-08-19  7028  		return -EACCES;
219f9ea4d3b797 Xin Long                2019-08-19  7029  
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7030  	ch = asoc->peer.peer_chunks;
5e739d1752aca4 Vlad Yasevich           2008-08-21  7031  	if (!ch)
5e739d1752aca4 Vlad Yasevich           2008-08-21  7032  		goto num;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7033  
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7034  	/* See if the user provided enough room for all the data */
3c918704921412 Xin Long                2017-06-30  7035  	num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);
0cf004ffb61cd3 Michael Bommarito       2026-04-15 @7036  	if (len < sizeof(struct sctp_authchunks) + num_chunks)

This is a m68k-linux-gcc build (32 bits).  sizeof(struct sctp_paramhdr)
is 4 and sizeof(struct sctp_authchunks) is 8 so on a 32bit system if
num_chunks U32_MAX - 4 then the "sizeof(struct sctp_authchunks) +
num_chunks" math could overflow.

65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7037  		return -EINVAL;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7038  
5e739d1752aca4 Vlad Yasevich           2008-08-21  7039  	if (copy_to_user(to, ch->chunks, num_chunks))

It doesn't really cause a problem these days because copy_to_user()
doesn't accept sizes more than INT_MAX but it would trigger a warning.

65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7040  		return -EFAULT;
5e739d1752aca4 Vlad Yasevich           2008-08-21  7041  num:
5e739d1752aca4 Vlad Yasevich           2008-08-21  7042  	len = sizeof(struct sctp_authchunks) + num_chunks;
8d72651d86e9c7 wangweidong             2013-12-23  7043  	if (put_user(len, optlen))
8d72651d86e9c7 wangweidong             2013-12-23  7044  		return -EFAULT;
7e8616d8e7731b Vlad Yasevich           2008-02-27  7045  	if (put_user(num_chunks, &p->gauth_number_of_chunks))
7e8616d8e7731b Vlad Yasevich           2008-02-27  7046  		return -EFAULT;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7047  	return 0;
65b07e5d0d09c7 Vlad Yasevich           2007-09-16  7048  }

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki