From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F58D3B2FF9 for ; Wed, 15 Jul 2026 03:35:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784086566; cv=none; b=Fu7kCdKF2jvu93crHtggcT64I9f/Xdjm2xvMae4Pfoq70Ms8Cv64d3hb4YlQPrFd9Zv2pPLXV0Pm4tkFaZTEN+3+xowWQlrDP8MPcEv84J8hYyOCQaQQPQa925lmvjlVPluZLiaPiiBstlonJ6yOHK/HmDuwyRWeahvfNPD8NWs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784086566; c=relaxed/simple; bh=tl9QUY60ANTH63SkBkkbYRa0mh0qVb/cgU5n6BRSkZs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ddcdtGn72/caPDHNwFZbhdWU/+JZKsnlUyIzfSeUQoOQOg2FLQncNC0U8gEEVRQO2/ArfZVB4HQ+0d5Dr86KCQiyeihtn/N6F3nLZwflzlRamCInAOCg9adPImZ97dEXyw6mYKCqLuBxwXZjenPSNwdrkoT4nPjPfwL0Co7M2A4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=DNnqsjS/; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="DNnqsjS/" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2caea3f742bso59048285ad.0 for ; Tue, 14 Jul 2026 20:35:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784086546; x=1784691346; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=ymvDeDodxFq3HgKKLyUeM3rErvPvsmK6UFUvd0diOrc=; b=DNnqsjS/SImdPVPfjMWu7EObi0d4fFvdi6Qh/LoBCMXyzl6EC2z9KefqXjWnBTBo/k 49qF5y4HmxaVTxTTsUnDB5CBWczBe9sl0fmax03fbyy1eGd8Wh49AvM5HgoOYXNbC4o4 bfQAqVsfoksuVfsPqg8SvDSRBlo2UxdqaVuPs6V4LjVhcnNYU+S/RjmwBTNlHCajx720 5cT+k/4qL+wt+37uCRMQq6+iQ6I9UlQ7YhCJReFrw7mT2xGGoWGRYBzNIJ9ewhodzSeu T/B4rZzBzPwxcKVOuHFtPJfBkT3btPaI4TmsBx40K9wJ4/Rw1gZ59kai9/+DHpMXVaPw dIDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784086546; x=1784691346; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ymvDeDodxFq3HgKKLyUeM3rErvPvsmK6UFUvd0diOrc=; b=Z04eH5oP0w66Vm8gI6Y8I6GDx8U6lWL5wlRvSjEVG116/pvU04TvtaEgD9ddEleMll STDvXp62bQsZhy+sT2z6Xj/dKjNK6oS1Eo63kAWQfdV20yVGdNAAYsLVuoR13V9M3FG7 qOwkUkUPQ24PUI99rlL0A/v1Si07S7ATbxhzGN4Nqmk+/8nl9s3C4Av4KacT3Zu/+CQa mDuAFTOYVsP8AW6m0elnyYmkWU5BNUudvN75sA+dxs/rPFJimjlIDFqs+nmH1dYBlPxC Euwof53ScSGkt+ophV5Aeh1xMKo8Sc8c9j/0Ozm6/3huWuS4ZYuOSSiWOksXwNG+xokm 2WNg== X-Forwarded-Encrypted: i=1; AHgh+RqfPxvVhttGdgVrTLDlh/dNmeg3iFL2dVZHl2SGuWd8UfSqTNZLQkCTzRys2hBRgPeaTOirjs4=@vger.kernel.org X-Gm-Message-State: AOJu0YzAX5OSCk3Gz57/9hFe+yyFH9FXrNUoDeM8t63jBtknbgJ3k4dr Es3+3j/nslB48WL6dAj+auO2gMHDbc3AwqzoX2YBNPXTzu0l/F1RHRkX X-Gm-Gg: AfdE7cliLQ6atiBntQ+w+WM0M3R4nrKa2zAA3vOI0lhzzZZ1VRpP8xrFokVskRaALzR spIY2/AcP0voC5hpSyQ/a5Z4MskID3/MOQ0/YcixiYW3fnaK6wFabjXiIzTetdzrl9o/1GvSyx/ 8GonFwnOBfVIhHqftTdTLYYBPqEX/R8Nb/5yqGeS0nw65WP/Y0dnxg60ud8zeWIvDNXuZX0YQPP FH6zuE5B5g6wsfoy5uwzgZnvt4RGnVS4z3r6+YmBtRiXB1YZTPVMC+hyQd+PVOcaUSyehPaurMN V4ahzZAnLTdznede1m6C24GAytklYr5gekzM3oKTfssUxptccbM9TI40GmNF5yAeUA3M9JHQNMs dImZrRaZtTDsjWNik6U8l9OMTTJdZdlaEV17NiB3XR6Dd6QovnKKm8JmNcj3sBmMlwYtDD8UvxL AK5/Jz8xxVSsMpifXlD452eWMwu7T7ZD2vtAeTkYP1ppSH X-Received: by 2002:a17:903:2a88:b0:2cc:5f9f:54ed with SMTP id d9443c01a7336-2cef12fe180mr53236485ad.27.1784086546202; Tue, 14 Jul 2026 20:35:46 -0700 (PDT) Received: from localhost.localdomain ([2404:2280:2000:8007:d87:748:d87:748]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9d3d451sm125464325ad.65.2026.07.14.20.35.41 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 14 Jul 2026 20:35:45 -0700 (PDT) From: MingXuan To: Marcelo Ricardo Leitner , Xin Long Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, MingXuan , stable@vger.kernel.org Subject: [PATCH] sctp: diag: fix uninitialized stack leak via INET_DIAG_LOCALS/PEERS Date: Wed, 15 Jul 2026 11:35:36 +0800 Message-ID: <20260715033536.64963-1-omeux327@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit inet_diag_msg_sctpladdrs_fill() copies sizeof(union sctp_addr) (28 bytes, the size of sockaddr_in6) from each sctp_sockaddr_entry.a into the netlink INET_DIAG_LOCALS attribute and then only zeroes the bytes from offset 28 to sizeof(sockaddr_storage). The same pattern is used by inet_diag_msg_sctpaddrs_fill() for INET_DIAG_PEERS. The IPv4 address-filling helpers sctp_v4_from_addr_param() and sctp_v4_from_skb() only initialize the sockaddr_in portion (16 bytes) of the union sctp_addr; the trailing 12 bytes (offset 16..27, the sockaddr_in6-only region) are left uninitialized. Those bytes are propagated verbatim through sctp_add_bind_addr() (which copies sizeof(union sctp_addr)=28 bytes) and then copied straight to userspace by the diag fill functions, leaking 12 bytes of kernel stack residue per local/peer address to any process that can issue a SOCK_DIAG_BY_FAMILY dump for IPPROTO_SCTP. Fix it by computing the actually-initialized length of the address from its sa_family (struct sockaddr_in for AF_INET, the whole union otherwise) and copying only that many bytes into an already-zeroed sockaddr_storage slot, so the uninitialized tail is never read and never reaches userspace. Fixes: 8f840e47f190cbe61a96945c13e9551048d42cef ("sctp: add the sctp_diag.c file") Cc: stable@vger.kernel.org Signed-off-by: MingXuan --- net/sctp/diag.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/net/sctp/diag.c b/net/sctp/diag.c index d758f5c3e06e..12557e924cc2 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -85,8 +85,12 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb, info = nla_data(attr); rcu_read_lock(); list_for_each_entry_rcu(laddr, address_list, list) { - memcpy(info, &laddr->a, sizeof(laddr->a)); - memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a)); + size_t addr_len = laddr->a.sa.sa_family == AF_INET ? + sizeof(struct sockaddr_in) : + sizeof(struct sockaddr_in6); + + memset(info, 0, addrlen); + memcpy(info, &laddr->a, addr_len); info += addrlen; if (!--addrcnt) @@ -113,9 +117,12 @@ static int inet_diag_msg_sctpaddrs_fill(struct sk_buff *skb, info = nla_data(attr); list_for_each_entry(from, &asoc->peer.transport_addr_list, transports) { - memcpy(info, &from->ipaddr, sizeof(from->ipaddr)); - memset(info + sizeof(from->ipaddr), 0, - addrlen - sizeof(from->ipaddr)); + size_t addr_len = from->ipaddr.sa.sa_family == AF_INET ? + sizeof(struct sockaddr_in) : + sizeof(struct sockaddr_in6); + + memset(info, 0, addrlen); + memcpy(info, &from->ipaddr, addr_len); info += addrlen; } -- 2.50.1 (Apple Git-155)