Commit f14fe639 authored by Zhenghang Xiao's avatar Zhenghang Xiao Committed by Jakub Kicinski
Browse files

sctp: fix race between sctp_wait_for_connect and peeloff 



sctp_wait_for_connect() drops and re-acquires the socket lock while
waiting for the association to reach ESTABLISHED state. During this
window, another thread can peeloff the association to a new socket via
getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After
re-acquiring the old socket lock, sctp_wait_for_connect() returns
success without noticing the migration — the caller then accesses
the association under the wrong lock in sctp_datamsg_from_user().

Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()
already has, returning an error if the association was migrated while
we slept.

Fixes: 668c9beb ("sctp: implement assign_number for sctp_stream_interleave")
Signed-off-by: default avatarZhenghang Xiao <kipreyyy@gmail.com>
Acked-by: default avatarXin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260527032411.60959-1-kipreyyy@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent ab4ac5a9

net/sctp/socket.c

+2 −0
Original line number Diff line number Diff line
@@ -9403,6 +9403,8 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p) 
		release_sock(sk);

		current_timeo = schedule_timeout(current_timeo);

		lock_sock(sk);

		if (sk != asoc->base.sk)

			goto do_error;



		*timeo_p = current_timeo;

	}