From: Jun Yang sctp_getsockopt_local_auth_chunks() copies ntohs(length) - sizeof(paramhdr) bytes out of ch->chunks without bounding the count. For an association ch is the fixed-size asoc->c.auth_chunks[] array (sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS bytes), whose length field is restored from the received state cookie by sctp_unpack_cookie() and is not validated against the array size. A cookie carrying an oversized length makes copy_to_user() read past the array (out-of-bounds read). Bound the chunk count to SCTP_AUTH_MAX_CHUNKS before the copy. That is the most valid chunk bytes either source can hold, so legitimate output is unchanged, and it also covers a stored length smaller than the parameter header, which would otherwise underflow. Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.") Cc: stable@kernel.org Reported-by: TencentOS Corvus AI Signed-off-by: Jun Yang --- net/sctp/socket.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 9a6da4e0d741..3e9dacb772a0 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -7109,6 +7109,12 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, goto num; num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr); + /* asoc->c.auth_chunks[] holds at most SCTP_AUTH_MAX_CHUNKS bytes but its + * length is restored from the state cookie and is not bounded here; + * clamp so an oversized length cannot read past the array. + */ + if (num_chunks > SCTP_AUTH_MAX_CHUNKS) + num_chunks = SCTP_AUTH_MAX_CHUNKS; if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; -- 2.55.0