Re: [PATCH net 1/1] sctp: diag: reject stale associations in dump_one path

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Sat, 30 May 2026 23:57:14 +0800 you wrote:
> From: Zhao Zhang <[email protected]>
> 
> The SCTP exact sock_diag lookup can hold a transport reference, block on
> lock_sock(sk), and then resume after sctp_association_free() has marked
> the association dead and freed its bind address list.
> 
> When that happens, inet_assoc_attr_size() and
> inet_diag_msg_sctpasoc_fill() can still dereference association state
> that is no longer valid for reporting. In particular,
> inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a
> real sctp_sockaddr_entry and trigger an out-of-bounds read from
> unrelated association memory.
> 
> [...]

Here is the summary with links:
  - [net,1/1] sctp: diag: reject stale associations in dump_one path
    https://git.kernel.org/netdev/net/c/5eba3e48d78e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html