Re: [PATCH v5] sctp: reject forged cookie peer_addr with unknown address family

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 19 Oct 2026 15:37:57 +0800 you wrote:
> When cookie authentication is disabled, COOKIE-ECHO peer_addr is
> attacker-controlled. An invalid sa_family made sctp_get_af_specific()
> return NULL and crash in sctp_transport_init() on
> af_specific->sockaddr_len. Validate it with af->addr_valid() in
> sctp_unpack_cookie(), which also rejects a mismatched family, e.g.
> an AF_INET6 peer_addr on an IPv4 socket that would later crash in
> sctp_v6_get_dst() on inet6_sk(sk)->opt. Validate a copy of peer_addr,
> since addr_valid() rewrites a v4-mapped v6 address in place and the
> cookie still lives in the received skb, which is not guaranteed to
> be unshared. Store the validated copy in the new association and
> pass it to sctp_process_init() instead of the raw cookie, so a
> v4-mapped v6 address is normalised to AF_INET before the association
> and its primary transport are built from it.
> 
> [...]

Here is the summary with links:
  - [v5] sctp: reject forged cookie peer_addr with unknown address family
    https://git.kernel.org/netdev/net/c/9802123ceca8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html