In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto[EOL][EOL]syzbot reported a possible shift-out-of-bounds [1][EOL][EOL]Blamed commit added rto_alpha_max and rto_beta_max set to 1000.[EOL][EOL]It is unclear if some sctp users are setting very large rto_alpha[EOL]and/or rto_beta.[EOL][EOL]In order to prevent user regression, perform the test at run time.[EOL][EOL]Also add READ_ONCE() annotations as sysctl values can change under us.[EOL][EOL][1][EOL][EOL]UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41[EOL]shift exponent 64 is too large for 32-bit type 'unsigned int'[EOL]CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)[EOL]Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025[EOL]Call Trace:[EOL] <TASK>[EOL] __dump_stack lib/dump_stack.c:94 [inline][EOL] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120[EOL] ubsan_epilogue lib/ubsan.c:233 [inline][EOL] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494[EOL] sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509[EOL] sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502[EOL] sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338[EOL] sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline][EOL] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]
