Re: [PATCH net] sctp: account for chunk padding in sctp_init_cause()

[Xin Long]

On Tue, Oct 27, 2026 at 4:32 AM Masafumi Suzuki
<shengshilingmu97@xxxxxxxxx> wrote:
>
> sctp_init_cause() accepts a chunk when skb_tailroom() can hold the
> cause header and the payload. sctp_addto_chunk() then writes 0-3
> bytes of padding before that header so the chunk stays 4-byte
> aligned. The check does not include the padding, and the following
> skb_put() calls skb_over_panic() from softirq.
>
> Count the padding sctp_addto_chunk() is about to write. The cause
> length on the wire stays the header plus the payload.
>
> Fixes: 8914f4bace3f ("sctp: add sctp_make_op_error_limited and reuse inner functions")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Masafumi Suzuki <shengshilingmu97@xxxxxxxxx>
> ---
>  net/sctp/sm_make_chunk.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> index 84a4c97d0f75..8933caadcdb6 100644
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -133,20 +133,27 @@ static const struct sctp_paramhdr prsctp_param = {
>   * cause codes will be embedded inside an abort chunk.
>   */
>  int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
>                     size_t paylen)
>  {
>         struct sctp_errhdr err;
> +       int chunklen, padlen;
>         __u16 len;
>
>         /* Cause code constants are now defined in network order.  */
>         err.cause = cause_code;
>         len = sizeof(err) + paylen;
>         err.length = htons(len);
>
> -       if (skb_tailroom(chunk->skb) < len)
> +       /* sctp_addto_chunk() pads the chunk up to a 4-byte boundary before
> +        * appending the cause, so account for that padding here as well.
> +        */
> +       chunklen = ntohs(chunk->chunk_hdr->length);
> +       padlen = SCTP_PAD4(chunklen) - chunklen;
> +
> +       if (skb_tailroom(chunk->skb) < padlen + len)
>                 return -ENOSPC;
>
>         chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(err), &err);
>
>         return 0;
>  }
> --
> 2.47.0

Acked-by: Xin Long <lucien.xin@xxxxxxxxx>