Re: [PATCH v2] sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

[Xin Long]

On Sun, Jul 12, 2026 at 11:21 PM 寒泉 <eilaimemedsnaimel@xxxxxxxxx> wrote:
>
> From: HanQuan <eilaimemedsnaimel@xxxxxxxxx>
>
> sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
> capacity limit for ep->auth_chunk_list, allowing it to hold up to
> 20 chunk entries (param_hdr.length up to 24). However, the copy
> destination asoc->c.auth_chunks in struct sctp_cookie is only
> SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
> chunks are added, sctp_association_init() memcpy overflows the
> destination by up to 4 bytes.
>
> Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching
> the destination capacity.
>
> Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals")
> Signed-off-by: HanQuan <eilaimemedsnaimel@xxxxxxxxx>
> ---
>  net/sctp/auth.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sctp/auth.c b/net/sctp/auth.c
> index be9782760f50..c901d373af80 100644
> --- a/net/sctp/auth.c
> +++ b/net/sctp/auth.c
> @@ -672,7 +672,7 @@ int sctp_auth_ep_add_chunkid(struct sctp_endpoint *ep, __u8 chunk_id)
>         /* Check if we can add this chunk to the array */
>         param_len = ntohs(p->param_hdr.length);
>         nchunks = param_len - sizeof(struct sctp_paramhdr);
> -       if (nchunks == SCTP_NUM_CHUNK_TYPES)
> +       if (nchunks == SCTP_AUTH_MAX_CHUNKS)
>                 return -EINVAL;
>
>         p->chunks[nchunks] = chunk_id;
> --
> 2.43.0
>
Acked-by: Xin Long <lucien.xin@xxxxxxxxx>