Re: [PATCH v4 net-next] sctp: auth: break when skb_clone fails for auth_chunk

[Xin Long]

On Mon, Jul 20, 2026 at 9:56 PM luoqing <l1138897701@xxxxxxx> wrote:
>
> From: Qing Luo <luoqing@xxxxxxxxxx>
>
> When processing AUTH + COOKIE-ECHO packets, if skb_clone() fails
> due to memory pressure, chunk->auth_chunk is NULL. The original
> code still sets chunk->auth = 1 and continues, leaving the
> COOKIE-ECHO to be processed without a valid auth_chunk for
> deferred verification.
>
> The intent of not setting auth was to drop the chunk earlier,
> but in sctp_endpoint_bh_rcv() asoc is NULL for new connections,
> so sctp_auth_recv_cid() returns 0 and the early check is
> ineffective.
>
> Fix by breaking out of the receive loop when skb_clone() fails,
> dropping the entire packet since the AUTH data needed for
> COOKIE-ECHO verification cannot be preserved.
>
> Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk")
> Signed-off-by: Qing Luo <luoqing@xxxxxxxxxx>
> ---
>  net/sctp/associola.c   | 2 ++
>  net/sctp/endpointola.c | 2 ++
>  2 files changed, 4 insertions(+)
>
> diff --git a/net/sctp/associola.c b/net/sctp/associola.c
> index 62d3cc155809..7741f982e368 100644
> --- a/net/sctp/associola.c
> +++ b/net/sctp/associola.c
> @@ -999,6 +999,8 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
>                         if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
>                                 chunk->auth_chunk = skb_clone(chunk->skb,
>                                                               GFP_ATOMIC);
> +                               if (!chunk->auth_chunk)
> +                                       break;
>                                 chunk->auth = 1;
>                                 continue;
>                         }
> diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
> index dfb1719275db..9675370a46da 100644
> --- a/net/sctp/endpointola.c
> +++ b/net/sctp/endpointola.c
> @@ -368,6 +368,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
>                         if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
>                                 chunk->auth_chunk = skb_clone(chunk->skb,
>                                                                 GFP_ATOMIC);
> +                               if (!chunk->auth_chunk)
> +                                       break;
>                                 chunk->auth = 1;
>                                 continue;
>                         }
> --
> 2.25.1
>
>

The sashiko suggests adding chunk->pdiscard = 1 and continue to avoid
stalling the queue.

                                if (!chunk->auth_chunk) {
                                        chunk->pdiscard = 1;
                                        continue;
                                }

Also, as the original issue was already addressed in the other patch,
you should delete the "Fixes:" tag from this patch. This patch is more
like to discard the packet early if the skb_clone() fails.

Thanks.