From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B80BE426693; Mon, 17 Aug 2026 14:45:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977952; cv=none; b=m9i8/5xQh1SgI5mx48RwibkDY6zk8ZpjnTXDqRFPHLzy6mDgfYr2L2J04AMTTp1ZBxp2+b5i4E8Zavd0rvrBpnNDWsqjv0jkU0I7GvCHR96qlxXSGcHbzBpelzWP/0kAp7TqeaLBAJ6nLAN/xXTnwHByksv81/RyOvx2DhTMhFI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977952; c=relaxed/simple; bh=UWeosrbBhqO4Pu1he9P79zCCxvh0upaa2mo1Uy5hYI0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U1eA4G2tsH2SohB8lLQsF2RDSqEU0oXT4T+i5Cx36Q5oBTDUI+JuuL9J/Qfyp/aSGg2jOF2hhmfQn3xHwM17nTAVUOv7MXHwat1VIEXbqhMqRPEKwUTFmjOkq/dhaG0D8WVTR7GPCfiBu+x4AAQFmlBRJyO2gE38ZnJHq4IRebg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aojQcznb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="aojQcznb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9A981F000E9; Mon, 17 Aug 2026 14:45:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786977951; bh=QTt68oMnv3LH7qxFPIeKh9JBszi0uFE5FlXGNgHFhh0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aojQcznb/ISZT+SXAvR8oNDLM1NTSsKQ9nRGWdxIjx2LeDbylhSfj30X+Yc37o9qk JsDhVKHa7LG2u6oEE8G5Wsmk4/nGRdSFj1aLBEucVLoWr+pAI2rqI133WQLf9rKDRR 4RpG6dPgUZW2OXU6+aI5xKNYLtAXr16CDDn2sPxc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Qing Luo , Xin Long , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.12 051/181] sctp: fix addip_serial increment on ASCONF_ACK allocation failure Date: Mon, 17 Aug 2026 15:32:25 +0200 Message-ID: <20260817132537.413699339@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132535.394764707@linuxfoundation.org> References: <20260817132535.394764707@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Qing Luo [ Upstream commit aa2e13ae8d3cbe2c15ef4f7e971b2de0832794aa ] In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate the ASCONF_ACK chunk due to memory pressure, the code jumps to the done label where asoc->peer.addip_serial is unconditionally incremented. This leaves the peer's ASCONF (serial N) unacknowledged while the local endpoint now expects serial N+1. When the peer retransmits serial N, it falls into the serial < addip_serial + 1 branch , which attempts to look up a cached ACK for serial N. No cached ACK exists since the allocation failed, so the retransmission is silently discarded. The peer eventually times out and ABORTs the association. Move the addip_serial increment inside the if (asconf_ack) block so that the serial number is only advanced when the ASCONF_ACK is successfully created and cached. This way, on allocation failure, the serial number is unchanged and the peer's retransmitted ASCONF will be correctly re-processed. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Qing Luo Acked-by: Xin Long Link: https://patch.msgid.link/20260804025514.241767-1-l1138897701@163.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/sctp/sm_make_chunk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 27a7739a7d424..b6eb79ef6a55d 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -3354,12 +3354,11 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, goto done; } done: - asoc->peer.addip_serial++; - /* If we are sending a new ASCONF_ACK hold a reference to it in assoc * after freeing the reference to old asconf ack if any. */ if (asconf_ack) { + asoc->peer.addip_serial++; sctp_chunk_hold(asconf_ack); list_add_tail(&asconf_ack->transmitted_list, &asoc->asconf_ack_list); -- 2.53.0