On Mon, Aug 26, 2024 at 12:09 PM syzbot <syzbot+f0cbb34d39392f2746ca@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > > Hello, > > syzbot found the following issue on: > > HEAD commit: d2bafcf224f3 Merge tag 'cgroup-for-6.11-rc4-fixes' of git:.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=15e9b7f5980000 > kernel config: https://syzkaller.appspot.com/x/.config?x=62f882de896675a6 > dashboard link: https://syzkaller.appspot.com/bug?extid=f0cbb34d39392f2746ca > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > > Unfortunately, I don't have any reproducer for this issue yet. > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/17f6ee87834d/disk-d2bafcf2.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/7783769858d1/vmlinux-d2bafcf2.xz > kernel image: https://storage.googleapis.com/syzbot-assets/45248109d188/bzImage-d2bafcf2.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+f0cbb34d39392f2746ca@xxxxxxxxxxxxxxxxxxxxxxxxx > > ===================================================== > BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3702 it seems we need a similar fix in sctp_sf_ootb() as: commit 50619dbf8db77e98d821d615af4f634d08e22698 Author: Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx> Date: Mon Jun 28 16:13:42 2021 -0300 sctp: add size validation when walking chunks diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 5adf0c0a6c1a..71b9feaf36bc 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -3741,7 +3741,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, } ch = (struct sctp_chunkhdr *)ch_end; - } while (ch_end < skb_tail_pointer(skb)); + } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); if (ootb_shut_ack) return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
