Subject: Re: [PATCH net] netfilter: nf_conntrack_sctp: validate state value in nlattr_to_sctp()

From: Florian Westphal <[email-masked]>
Date: Sat, 7 Mar 2026 19:24:00 +0100

Hyunwoo Kim <[email-masked]> wrote:
> diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> index 7c6f7c9f7332..cbee99be7b5e 100644
> --- a/net/netfilter/nf_conntrack_proto_sctp.c
> +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> @@ -612,6 +612,9 @@ static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
>  	    !tb[CTA_PROTOINFO_SCTP_VTAG_REPLY])
>  		return -EINVAL;
>  
> +	if (nla_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]) >= SCTP_CONNTRACK_MAX)
> +		return -EINVAL;

Like other, similar bug classes, I would prefer this to be solved via
netlink policy fixup.