Re: [PATCH net] sctp: fix race between sctp_wait_for_connect and peeloff

On Tue, May 26, 2026 at 6:08 AM Zhenghang Xiao <[email protected]> wrote:
>
> sctp_wait_for_connect() drops and re-acquires the socket lock while
> waiting for the association to reach ESTABLISHED state. During this
> window, another thread can peeloff the association to a new socket via
> getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After
> re-acquiring the old socket lock, sctp_wait_for_connect() returns
> success without noticing the migration — the caller then accesses
> the association under the wrong lock in sctp_datamsg_from_user().
>
> Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()
> already has, returning an error if the association was migrated while
> we slept.
>
> Fixes: 668c9beb9020 ("sctp: implement assign_number for sctp_stream_interleave")
> Signed-off-by: Zhenghang Xiao <[email protected]>
> ---
>  net/sctp/socket.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index 1d2568bb6bc2..66e12fb0c646 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -9403,6 +9403,8 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
>                 release_sock(sk);
>                 current_timeo = schedule_timeout(current_timeo);
>                 lock_sock(sk);
> +               if (sk != asoc->base.sk)
> +                       goto do_error;
>
>                 *timeo_p = current_timeo;
>         }
> --
> 2.50.1 (Apple Git-155)
>

Patch looks good to me.

Please resend it with the recipients from get_maintainer.pl included,
especially [email protected].


# ./scripts/get_maintainer.pl net/sctp/socket.c
Marcelo Ricardo Leitner <[email protected]> (maintainer:SCTP PROTOCOL)
Xin Long <[email protected]> (maintainer:SCTP PROTOCOL)
"David S. Miller" <[email protected]> (maintainer:NETWORKING [GENERAL])
Eric Dumazet <[email protected]> (maintainer:NETWORKING [GENERAL])
Jakub Kicinski <[email protected]> (maintainer:NETWORKING [GENERAL])
Paolo Abeni <[email protected]> (maintainer:NETWORKING [GENERAL])
Simon Horman <[email protected]> (reviewer:NETWORKING [GENERAL])
[email protected] (open list:SCTP PROTOCOL)
[email protected] (open list:NETWORKING [GENERAL])
[email protected] (open list)

Thanks.