[PATCH v2] sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

[PATCH v2] sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

[寒泉]

From: HanQuan <eilaimemedsnaimel@gmail.com>

sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
capacity limit for ep->auth_chunk_list, allowing it to hold up to
20 chunk entries (param_hdr.length up to 24). However, the copy
destination asoc->c.auth_chunks in struct sctp_cookie is only
SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
chunks are added, sctp_association_init() memcpy overflows the
destination by up to 4 bytes.

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching
the destination capacity.

Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals")
Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
---
 net/sctp/auth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index be9782760f50..c901d373af80 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -672,7 +672,7 @@ int sctp_auth_ep_add_chunkid(struct sctp_endpoint *ep, __u8 chunk_id)
 	/* Check if we can add this chunk to the array */
 	param_len = ntohs(p->param_hdr.length);
 	nchunks = param_len - sizeof(struct sctp_paramhdr);
-	if (nchunks == SCTP_NUM_CHUNK_TYPES)
+	if (nchunks == SCTP_AUTH_MAX_CHUNKS)
 		return -EINVAL;
 
 	p->chunks[nchunks] = chunk_id;
-- 
2.43.0

Re: [PATCH v2] sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

[Xin Long]

On Sun, Jul 12, 2026 at 11:21 PM 寒泉 <eilaimemedsnaimel@gmail.com> wrote:
>
> From: HanQuan <eilaimemedsnaimel@gmail.com>
>
> sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
> capacity limit for ep->auth_chunk_list, allowing it to hold up to
> 20 chunk entries (param_hdr.length up to 24). However, the copy
> destination asoc->c.auth_chunks in struct sctp_cookie is only
> SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
> chunks are added, sctp_association_init() memcpy overflows the
> destination by up to 4 bytes.
>
> Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching
> the destination capacity.
>
> Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals")
> Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
> ---
>  net/sctp/auth.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sctp/auth.c b/net/sctp/auth.c
> index be9782760f50..c901d373af80 100644
> --- a/net/sctp/auth.c
> +++ b/net/sctp/auth.c
> @@ -672,7 +672,7 @@ int sctp_auth_ep_add_chunkid(struct sctp_endpoint *ep, __u8 chunk_id)
>         /* Check if we can add this chunk to the array */
>         param_len = ntohs(p->param_hdr.length);
>         nchunks = param_len - sizeof(struct sctp_paramhdr);
> -       if (nchunks == SCTP_NUM_CHUNK_TYPES)
> +       if (nchunks == SCTP_AUTH_MAX_CHUNKS)
>                 return -EINVAL;
>
>         p->chunks[nchunks] = chunk_id;
> --
> 2.43.0
>
Acked-by: Xin Long <lucien.xin@gmail.com>

Re: [PATCH v2] sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 13 Jul 2026 03:20:21 +0000 you wrote:
> From: HanQuan <eilaimemedsnaimel@gmail.com>
> 
> sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
> capacity limit for ep->auth_chunk_list, allowing it to hold up to
> 20 chunk entries (param_hdr.length up to 24). However, the copy
> destination asoc->c.auth_chunks in struct sctp_cookie is only
> SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
> chunks are added, sctp_association_init() memcpy overflows the
> destination by up to 4 bytes.
> 
> [...]

Here is the summary with links:
  - [v2] sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
    https://git.kernel.org/netdev/net/c/ff04b26794a1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html