Proof/Linux kernel/sctp: inqueue chunk length
A chunk shorter than its own header.
SCTP chunks carry a four-byte header, and the declared length includes it. The inqueue parser accepted declared lengths below that floor, and a zero-length chunk could hold the receive softirq in place.
This is the second SCTP fix on this record authored and signed off by Charles Vosburgh. It was applied to netdev/net.git by Jakub Kicinski on 30 August 2026, carrying Acked-by: Xin Long.
Every SCTP chunk begins with a four-byte header, and the declared chunk length counts that header. A declared length below four does not describe a chunk at all.
The inqueue parser, sctp_inq_pop(), is the boundary where an incoming packet is split into individual chunks for the rest of the stack. It is the natural place to enforce that floor, because everything downstream is entitled to assume it holds.
The public commit message states the defect directly: sctp_inq_pop() accepted shorter declared lengths than the four-byte header requires. A chunk declaring a length of zero therefore passed the parser and was handed onward.
The consequence recorded in the commit is that malformed zero-length chunks could cause the receive softirq to lock up, in a configuration where ASCONF is protected by SCTP-AUTH policies. The work does not complete and does not yield.
Malformed packet
An SCTP packet containing a chunk whose declared length is below the header floor.
sctp_inq_pop()
The declared length is accepted rather than rejected as impossible.
ASCONF under AUTH
The configuration in which the commit records the lockup.
Softirq lockup
Receive-side processing stops making progress.
The patch validates the chunk length against the four-byte minimum at the inqueue parser boundary, and marks the packet for discard when the check fails — before any further processing takes place.
Placing the check at the parser boundary rather than in each consumer is the substance of the fix. A floor enforced once at the edge is an invariant; the same floor checked in several consumers is a convention that a future consumer will forget.
The commit records Fixes: bbd0d59 and references commit f967455.
The mainline commit records the following trailers:
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Charles Vosburgh
Signed-off-by: Jakub Kicinski <kuba@kernel.org>This is an authored patch, not a report. It is counted on this site under authored mainline fixes, separately from the two KSMBD fixes that carry Reported-by credit with patches written by Namjae Jeon.
| Claim | Status | Basis |
|---|---|---|
| Mainline inclusion | Verified | present in torvalds/linux |
| Author credit | Verified | commit author and Signed-off-by trailer |
| Maintainer review | Verified | Acked-by: Xin Long |
| Stable backports | None verified | no stable cherry-pick identified at time of writing |
| CVE assignment | None verified | no public CVE record identified |
The last two rows are stated as absences rather than omitted. Neither a stable backport nor a CVE is claimed for this fix.
- Mainline commit 6cfc1b90cb86 — sctp: validate chunk length in the inqueue parser
- The first authored SCTP fix — Adaptation Indication parameter length
Credit: Patch authored and signed off by Charles Vosburgh; reviewed by Xin Long; applied by Jakub Kicinski. Research was SecHive-assisted through source mapping and hypothesis generation; patch authorship, runtime testing, submission and maintainer correspondence were human. The private reproducer referenced by the commit is not published.