Re: [PATCH net v2 0/2] sctp: validate INIT in COOKIE-ECHO when auth disabled

On Sat, Jun 20, 2026 at 11:10 AM Xin Long <[email protected]> wrote:
>
> This series fixes a security gap in SCTP's COOKIE-ECHO handling when
> cookie authentication is disabled.
>
> Currently, INIT chunks embedded in cookies are not re-verified after
> unpacking, creating a vulnerability when cookie_auth_enable=0. This
> series first refactors error handling, then adds the missing validation.
>
> Changes in v2: see individual patch changelogs for details.
>
> Xin Long (2):
>   sctp: factor out INIT verification failure handling
>   sctp: add INIT verification after cookie unpacking
>
I will drop Patch 1/2, and call sctp_sf_pdiscard() for err path in Patch
2/2 on v3, as it makes more sense to discard the packet if embedded INIT
chunk validation fails, consistent with malformed cookie handling.

>  net/sctp/sm_make_chunk.c |   3 +-
>  net/sctp/sm_statefuns.c  | 220 ++++++++++++++++++++-------------------
>  2 files changed, 117 insertions(+), 106 deletions(-)
>
> --
> 2.47.1
>