Re: [PATCH net v3] sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

[email protected] Wed, 10 Jun 2026 01:20:08 +0000

Newsgroups	org.kernel.vger.linux-sctp,org.kernel.vger.linux-kernel,org.kernel.vger.netdev
Message-ID	<178105440888.2779729.14941795177786710168.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Mon,  8 Jun 2026 08:22:34 -0400 you wrote:
> __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF
> chunk can hold the ADDIP header and a parameter header, then calls
> af->from_addr_param(), which reads the full address (16 bytes for IPv6)
> trusting the parameter's declared length.
> 
> An unauthenticated peer can send a truncated trailing ASCONF chunk that
> declares an IPv6 address parameter but stops after the 4-byte parameter
> header; reached from the no-association lookup path, from_addr_param() then
> reads uninitialized bytes past the parameter.
> 
> [...]

Here is the summary with links:
  - [net,v3] sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
    https://git.kernel.org/netdev/net/c/f8373d7090b7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html