Re: [PATCH net] sctp: Hold RCU read lock while iterating over address list

> Yes, there's a path not holding sock lock:
> 
>   sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

Ok, thanks for the clarification.

> Kuniyuki is right about the TOCTOU issue, we do need a check there:
> 
>                 if (!--addrcnt)
>                         break;
> 
> BTW, there is another addrcnt thing in inet_assoc_attr_size(), I think you
> can fix it in another patch, like moving nlmsg_new(inet_assoc_attr_size(assoc))
> under the lock_sock() in sctp_sock_dump_one() and delete _rcu?

I've sent out two separate patches for these issues.