[PATCH net] sctp: validate the body of a STALE_COOKIE error before reading it

[PATCH net] sctp: validate the body of a STALE_COOKIE error before reading it

[Xiang Mei]

sctp_sf_do_5_2_6_stale() reads the 32-bit Measure of Staleness that
follows the error header:

	stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));

without checking that the STALE_COOKIE cause actually carries that
4-byte body. sctp_walk_errors() in the caller only requires
err->length >= sizeof(struct sctp_errhdr), so a peer can send an 8-byte
ERROR chunk whose sole STALE_COOKIE cause has length == 4 and no body.
It passes sctp_chunk_length_valid() (>= 8) and the error walk, yet the
staleness read reaches past the validated cause.

When that is the only chunk in the packet the cause ends exactly at
skb_tail (sctp_inq_pop() discards only when chunk_end > skb_tail), so
the read stays in-bounds of the skb head slab object but past the packet
data. The value is folded into the COOKIE_PRESERVATIVE parameter of the
retransmitted INIT and reflected to the peer, leaking adjacent kernel
slab bytes.

Discard the chunk when the staleness field falls outside the validated
chunk data.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
 net/sctp/sm_statefuns.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index d23d935e128e..e4b4b63162cf 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2592,6 +2592,9 @@ static enum sctp_disposition sctp_sf_do_5_2_6_stale(
 
 	err = (struct sctp_errhdr *)(chunk->skb->data);
 
+	if ((u8 *)err + sizeof(*err) + sizeof(__be32) > chunk->chunk_end)
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
 	/* When calculating the time extension, an implementation
 	 * SHOULD use the RTT information measured based on the
 	 * previous COOKIE ECHO / ERROR exchange, and should add no
-- 
2.43.0

Re: [PATCH net] sctp: validate the body of a STALE_COOKIE error before reading it

[Xin Long]

On Sat, Jul 4, 2026 at 8:31 PM Xiang Mei <xmei5@asu.edu> wrote:
>
> sctp_sf_do_5_2_6_stale() reads the 32-bit Measure of Staleness that
> follows the error header:
>
>         stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
>
> without checking that the STALE_COOKIE cause actually carries that
> 4-byte body. sctp_walk_errors() in the caller only requires
> err->length >= sizeof(struct sctp_errhdr), so a peer can send an 8-byte
> ERROR chunk whose sole STALE_COOKIE cause has length == 4 and no body.
> It passes sctp_chunk_length_valid() (>= 8) and the error walk, yet the
> staleness read reaches past the validated cause.
>
> When that is the only chunk in the packet the cause ends exactly at
> skb_tail (sctp_inq_pop() discards only when chunk_end > skb_tail), so
> the read stays in-bounds of the skb head slab object but past the packet
> data. The value is folded into the COOKIE_PRESERVATIVE parameter of the
> retransmitted INIT and reflected to the peer, leaking adjacent kernel
> slab bytes.
>
> Discard the chunk when the staleness field falls outside the validated
> chunk data.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Weiming Shi <bestswngs@gmail.com>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Xiang Mei <xmei5@asu.edu>
> ---
>  net/sctp/sm_statefuns.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
> index d23d935e128e..e4b4b63162cf 100644
> --- a/net/sctp/sm_statefuns.c
> +++ b/net/sctp/sm_statefuns.c
> @@ -2592,6 +2592,9 @@ static enum sctp_disposition sctp_sf_do_5_2_6_stale(
>
>         err = (struct sctp_errhdr *)(chunk->skb->data);
>
> +       if ((u8 *)err + sizeof(*err) + sizeof(__be32) > chunk->chunk_end)
> +               return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
> +
>         /* When calculating the time extension, an implementation
>          * SHOULD use the RTT information measured based on the
>          * previous COOKIE ECHO / ERROR exchange, and should add no
> --
> 2.43.0
>

I think this is a dup of
https://lore.kernel.org/netdev/20260704033545.2438373-2-bestswngs@gmail.com/.

Thanks.

Re: [PATCH net] sctp: validate the body of a STALE_COOKIE error before reading it

[Xiang Mei]

Thanks for the reminder. I didn't notice that Weiming has patched it.
Sorry about that.

Xiang

On Sun, Jul 5, 2026 at 12:13 PM Xin Long <lucien.xin@gmail.com> wrote:
>
> On Sat, Jul 4, 2026 at 8:31 PM Xiang Mei <xmei5@asu.edu> wrote:
> >
> > sctp_sf_do_5_2_6_stale() reads the 32-bit Measure of Staleness that
> > follows the error header:
> >
> >         stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
> >
> > without checking that the STALE_COOKIE cause actually carries that
> > 4-byte body. sctp_walk_errors() in the caller only requires
> > err->length >= sizeof(struct sctp_errhdr), so a peer can send an 8-byte
> > ERROR chunk whose sole STALE_COOKIE cause has length == 4 and no body.
> > It passes sctp_chunk_length_valid() (>= 8) and the error walk, yet the
> > staleness read reaches past the validated cause.
> >
> > When that is the only chunk in the packet the cause ends exactly at
> > skb_tail (sctp_inq_pop() discards only when chunk_end > skb_tail), so
> > the read stays in-bounds of the skb head slab object but past the packet
> > data. The value is folded into the COOKIE_PRESERVATIVE parameter of the
> > retransmitted INIT and reflected to the peer, leaking adjacent kernel
> > slab bytes.
> >
> > Discard the chunk when the staleness field falls outside the validated
> > chunk data.
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Reported-by: Weiming Shi <bestswngs@gmail.com>
> > Assisted-by: Claude:claude-opus-4-8
> > Signed-off-by: Xiang Mei <xmei5@asu.edu>
> > ---
> >  net/sctp/sm_statefuns.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
> > index d23d935e128e..e4b4b63162cf 100644
> > --- a/net/sctp/sm_statefuns.c
> > +++ b/net/sctp/sm_statefuns.c
> > @@ -2592,6 +2592,9 @@ static enum sctp_disposition sctp_sf_do_5_2_6_stale(
> >
> >         err = (struct sctp_errhdr *)(chunk->skb->data);
> >
> > +       if ((u8 *)err + sizeof(*err) + sizeof(__be32) > chunk->chunk_end)
> > +               return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
> > +
> >         /* When calculating the time extension, an implementation
> >          * SHOULD use the RTT information measured based on the
> >          * previous COOKIE ECHO / ERROR exchange, and should add no
> > --
> > 2.43.0
> >
>
> I think this is a dup of
> https://lore.kernel.org/netdev/20260704033545.2438373-2-bestswngs@gmail.com/.
>
> Thanks.