From: Qing Luo When processing AUTH + COOKIE-ECHO packets, if skb_clone() fails due to memory pressure, chunk->auth_chunk is NULL. The original code still sets chunk->auth = 1 and continues, leaving the COOKIE-ECHO to be processed without a valid auth_chunk for deferred verification. The intent of not setting auth was to drop the chunk earlier, but in sctp_endpoint_bh_rcv() asoc is NULL for new connections, so sctp_auth_recv_cid() returns 0 and the early check is ineffective. Fix by breaking out of the receive loop when skb_clone() fails, dropping the entire packet since the AUTH data needed for COOKIE-ECHO verification cannot be preserved. Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk") Signed-off-by: Qing Luo --- net/sctp/associola.c | 2 ++ net/sctp/endpointola.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/net/sctp/associola.c b/net/sctp/associola.c index 62d3cc155809..7741f982e368 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -999,6 +999,8 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { chunk->auth_chunk = skb_clone(chunk->skb, GFP_ATOMIC); + if (!chunk->auth_chunk) + break; chunk->auth = 1; continue; } diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c index dfb1719275db..9675370a46da 100644 --- a/net/sctp/endpointola.c +++ b/net/sctp/endpointola.c @@ -368,6 +368,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work) if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { chunk->auth_chunk = skb_clone(chunk->skb, GFP_ATOMIC); + if (!chunk->auth_chunk) + break; chunk->auth = 1; continue; } -- 2.25.1