From ed6c53b27be492643da2017c6f8e2732be5edf1a Mon Sep 17 00:00:00 2001 From: Masafumi Suzuki Date: Tue, 27 Oct 2026 17:24:05 +0900 Subject: [PATCH] sctp: account for chunk padding in sctp_init_cause() sctp_init_cause() accepts a chunk when skb_tailroom() can hold the cause header and the payload. sctp_addto_chunk() then writes 0-3 bytes of padding before that header so the chunk stays 4-byte aligned. The check does not include the padding, and the following skb_put() calls skb_over_panic() from softirq. Count the padding sctp_addto_chunk() is about to write. The cause length on the wire stays the header plus the payload. Found by LLM inspection, triggered and tested the fix. Fixes: 8914f4bace3f ("sctp: add sctp_make_op_error_limited and reuse inner functions") Cc: stable@vger.kernel.org Signed-off-by: Masafumi Suzuki Acked-by: Xin Long Link: https://patch.msgid.link/20261027082405.1297-1-shengshilingmu97@gmail.com Signed-off-by: Jakub Kicinski --- net/sctp/sm_make_chunk.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index d64c3ae33298..90de27284251 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -137,6 +137,7 @@ int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code, size_t paylen) { struct sctp_errhdr err; + int chunklen, padlen; __u16 len; /* Cause code constants are now defined in network order. */ @@ -144,7 +145,13 @@ int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code, len = sizeof(err) + paylen; err.length = htons(len); - if (skb_tailroom(chunk->skb) < len) + /* sctp_addto_chunk() pads the chunk up to a 4-byte boundary before + * appending the cause, so account for that padding here as well. + */ + chunklen = ntohs(chunk->chunk_hdr->length); + padlen = SCTP_PAD4(chunklen) - chunklen; + + if (skb_tailroom(chunk->skb) < padlen + len) return -ENOSPC; chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(err), &err);