]> git.hungrycats.org Git - linux/commit
sctp: fix SCTP_RESET_STREAMS stream list length limit
authorYousef Alhouseen <alhouseenyousef@gmail.com>
Thu, 25 Jun 2026 14:23:54 +0000 (16:23 +0200)
committerJakub Kicinski <kuba@kernel.org>
Sat, 27 Jun 2026 22:39:35 +0000 (15:39 -0700)
commit2b9f5ef534184bd81b8a4772780626c40eed1fd5
tree55ee039bfb26e5b8c7d70eb345ae410620d9d9b4
parent555c5475e787802eeae0d2b91c2f66c330db2767
sctp: fix SCTP_RESET_STREAMS stream list length limit

SCTP_RESET_STREAMS carries a flexible array of u16 stream IDs, but the
optlen clamps treat USHRT_MAX as a byte count and then multiply
sizeof(__u16) by the fixed header size.

That caps the copied and validated option buffer at about 64 KiB, which
rejects valid requests containing more than about half of the u16 stream
ID range.

Use struct_size_t() for the maximum struct sctp_reset_streams layout
instead, so the bound matches the flexible array described by
srs_number_streams.

Fixes: 5960cefab9df ("sctp: add a ceiling to optlen in some sockopts")
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260625142354.2600-1-alhouseenyousef@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/sctp/socket.c