[PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS

[Jun Yang <juny24602@gmail.com>]

From: Jun Yang <junvyyang@tencent.com>

sctp_getsockopt_local_auth_chunks() copies ntohs(length) -
sizeof(paramhdr) bytes out of ch->chunks without bounding the count.
For an association ch is the fixed-size asoc->c.auth_chunks[] array
(sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS bytes), whose length
field is restored from the received state cookie by sctp_unpack_cookie()
and is not validated against the array size.  A cookie carrying an
oversized length makes copy_to_user() read past the array (out-of-bounds
read).

Bound the chunk count to SCTP_AUTH_MAX_CHUNKS before the copy.  That is
the most valid chunk bytes either source can hold, so legitimate output
is unchanged, and it also covers a stored length smaller than the
parameter header, which would otherwise underflow.

Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
Cc: stable@kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Signed-off-by: Jun Yang <junvyyang@tencent.com>
---
 net/sctp/socket.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9a6da4e0d741..3e9dacb772a0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7109,6 +7109,12 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
 		goto num;
 
 	num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);
+	/* asoc->c.auth_chunks[] holds at most SCTP_AUTH_MAX_CHUNKS bytes but its
+	 * length is restored from the state cookie and is not bounded here;
+	 * clamp so an oversized length cannot read past the array.
+	 */
+	if (num_chunks > SCTP_AUTH_MAX_CHUNKS)
+		num_chunks = SCTP_AUTH_MAX_CHUNKS;
 	if (len < sizeof(struct sctp_authchunks) + num_chunks)
 		return -EINVAL;
 
-- 
2.55.0