[PATCH v4 net-next] sctp: auth: break when skb_clone fails for auth_chunk

[luoqing]

From: Qing Luo <luoqing@xxxxxxxxxx>

When processing AUTH + COOKIE-ECHO packets, if skb_clone() fails
due to memory pressure, chunk->auth_chunk is NULL. The original
code still sets chunk->auth = 1 and continues, leaving the
COOKIE-ECHO to be processed without a valid auth_chunk for
deferred verification.

The intent of not setting auth was to drop the chunk earlier,
but in sctp_endpoint_bh_rcv() asoc is NULL for new connections,
so sctp_auth_recv_cid() returns 0 and the early check is
ineffective.

Fix by breaking out of the receive loop when skb_clone() fails,
dropping the entire packet since the AUTH data needed for
COOKIE-ECHO verification cannot be preserved.

Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk")
Signed-off-by: Qing Luo <luoqing@xxxxxxxxxx>
---
 net/sctp/associola.c   | 2 ++
 net/sctp/endpointola.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 62d3cc155809..7741f982e368 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -999,6 +999,8 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
 			if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
 				chunk->auth_chunk = skb_clone(chunk->skb,
 							      GFP_ATOMIC);
+				if (!chunk->auth_chunk)
+					break;
 				chunk->auth = 1;
 				continue;
 			}
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index dfb1719275db..9675370a46da 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -368,6 +368,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
 			if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
 				chunk->auth_chunk = skb_clone(chunk->skb,
 								GFP_ATOMIC);
+				if (!chunk->auth_chunk)
+					break;
 				chunk->auth = 1;
 				continue;
 			}
-- 
2.25.1