Re: [PATCH net] sctp: validate Adaptation Indication parameter length

[Xin Long]

On Mon, Jul 27, 2026 at 7:18 PM Charles Vosburgh via B4 Relay
<devnull+trilobyte777.gmail.com@xxxxxxxxxx> wrote:
>
> From: Charles Vosburgh <trilobyte777@xxxxxxxxx>
>
> The Adaptation Layer Indication parameter contains a fixed 32-bit
> Adaptation Code Point after its parameter header. However,
> sctp_verify_param() accepts a header-only parameter because the generic
> parameter walker only requires the header to be present.
>
> sctp_process_param() then reads adaptation_ind beyond the declared
> parameter. When the malformed parameter is last in an INIT, the read
> starts at the receive skb tail, and the value is copied into the state
> cookie returned in the INIT ACK. This may disclose four receive-buffer
> tail bytes.
>
> Require the declared parameter length to match the fixed structure size
> and abort the association through the existing invalid parameter length
> path otherwise.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Charles Vosburgh <trilobyte777@xxxxxxxxx>
> ---
> Runtime-tested against net.git base 53658c6f3682.
>
> The patch passes checkpatch, builds net/sctp/sm_make_chunk.o, completes
> a full x86-64 bzImage build, and rejects the malformed header-only
> Adaptation Indication while preserving the baseline and valid
> eight-byte controls.
> ---
>  net/sctp/sm_make_chunk.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> index c02809264075..1f7a097802b4 100644
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -2168,7 +2168,13 @@ static enum sctp_ierror sctp_verify_param(struct net *net,
>         case SCTP_PARAM_HEARTBEAT_INFO:
>         case SCTP_PARAM_UNRECOGNIZED_PARAMETERS:
>         case SCTP_PARAM_ECN_CAPABLE:
> +               break;
>         case SCTP_PARAM_ADAPTATION_LAYER_IND:
> +               if (ntohs(param.p->length) != sizeof(*param.aind)) {
> +                       sctp_process_inv_paramlength(asoc, param.p,
> +                                                    chunk, err_chunk);
> +                       retval = SCTP_IERROR_ABORT;
> +               }
>                 break;
>
>         case SCTP_PARAM_SUPPORTED_EXT:
>
> ---
> base-commit: 53658c6f3682967a5e76ed4bc7462c4bdcddaec3
> change-id: 20260727-sctp-adaptation-length-aa16536552d0
>
> Best regards,
> --
> Charles Vosburgh <trilobyte777@xxxxxxxxx>
>
>

Acked-by: Xin Long <lucien.xin@xxxxxxxxx>

Note: case SCTP_PARAM_COOKIE_PRESERVATIVE may have the same problem,
it will be nice if you can confirm it and fix it in another patch.

Thanks.