From: Qing Luo When processing AUTH + COOKIE-ECHO packets in sctp_assoc_bh_rcv() and sctp_endpoint_bh_rcv(), the AUTH chunk skb is cloned and saved as chunk->auth_chunk for deferred verification. However, when skb_clone() fails under memory pressure, chunk->auth_chunk is set to NULL but chunk->auth is still unconditionally set to 1. This creates an inconsistent state where the chunk appears to be authenticated (auth == 1) but has no auth_chunk data to actually verify against. Later, sctp_auth_chunk_verify() sees a NULL auth_chunk and returns true, skipping authentication entirely and allowing unauthenticated COOKIE-ECHO packets to be accepted. Fix this by only setting chunk->auth = 1 when skb_clone() succeeds, ensuring the auth flag accurately reflects whether a valid auth_chunk is available for verification. Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk") Signed-off-by: Qing Luo --- net/sctp/associola.c | 3 ++- net/sctp/endpointola.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sctp/associola.c b/net/sctp/associola.c index 62d3cc155809..e54068305396 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -999,7 +999,8 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { chunk->auth_chunk = skb_clone(chunk->skb, GFP_ATOMIC); - chunk->auth = 1; + if (chunk->auth_chunk) + chunk->auth = 1; continue; } } diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c index dfb1719275db..3419748c66bc 100644 --- a/net/sctp/endpointola.c +++ b/net/sctp/endpointola.c @@ -368,7 +368,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work) if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { chunk->auth_chunk = skb_clone(chunk->skb, GFP_ATOMIC); - chunk->auth = 1; + if (chunk->auth_chunk) + chunk->auth = 1; continue; } } -- 2.25.1