Subject: Re: [PATCH net] netfilter: nf_conntrack_sctp: validate state value in nlattr_to_sctp()

From: Pablo Neira Ayuso <[email-masked]>
Date: Sun, 8 Mar 2026 11:42:43 +0100

On Sat, Mar 07, 2026 at 07:24:00PM +0100, Florian Westphal wrote:
> Hyunwoo Kim <[email-masked]> wrote:
> > diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> > index 7c6f7c9f7332..cbee99be7b5e 100644
> > --- a/net/netfilter/nf_conntrack_proto_sctp.c
> > +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> > @@ -612,6 +612,9 @@ static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
> >  	    !tb[CTA_PROTOINFO_SCTP_VTAG_REPLY])
> >  		return -EINVAL;
> >  
> > +	if (nla_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]) >= SCTP_CONNTRACK_MAX)
> > +		return -EINVAL;
> 
> Like other, similar bug classes, I would prefer this to be solved via
> netlink policy fixup.

Agreed, policy is the way to go to restrict this.

A single patch for all protocol trackers should be fine.