Re: [PATCH net] sctp: fix SCTP_RESET_STREAMS stream list length limit

Xin Long <[email protected]> Thu, 25 Jun 2026 10:12:41 -0400

Newsgroups	org.kernel.vger.linux-sctp,org.kernel.vger.linux-kernel,org.kernel.vger.netdev
Message-ID	<CADvbK_fkiQtAM7A7y3P9p4nA==pJpRt3FVeGT0adcs4UoNnAgA@mail.gmail.com>

On Wed, Jun 24, 2026 at 8:22 AM Yousef Alhouseen
<[email protected]> wrote:
>
> SCTP_RESET_STREAMS carries a flexible array of u16 stream IDs, but the
> optlen clamps treat USHRT_MAX as a byte count and then multiply
> sizeof(__u16) by the fixed header size.
>
> That caps the copied and validated option buffer at about 64 KiB, which
> rejects valid requests containing more than about half of the u16 stream
> ID range.
>
> Use struct_size_t() for the maximum struct sctp_reset_streams layout
> instead, so the bound matches the flexible array described by
> srs_number_streams.
>
> Signed-off-by: Yousef Alhouseen <[email protected]>

Fixes: 5960cefab9df ("sctp: add a ceiling to optlen in some sockopts")
Acked-by: Xin Long <[email protected]>