[PATCH net] sctp: fix sockets_allocated imbalance after sk_clone()

[PATCH net] sctp: fix sockets_allocated imbalance after sk_clone()

[Xin Long]

sk_clone() increments sockets_allocated and sets the socket refcount to 2.
SCTP performs additional accounting in sctp_clone_sock(), so the clone-time
increment must be undone to avoid double counting.

Note we cannot simply remove the SCTP-side increment, because the SCTP
destroy path in sctp_destroy_sock() only decrements sockets_allocated when
sp->ep is set, which may not be true for all failure paths in
sctp_clone_sock().

Fixes: 16942cf4d3e3 ("sctp: Use sk_clone() in sctp_accept().")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
 net/sctp/socket.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d2665bbd41a2..d0e7048230c0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4855,8 +4855,9 @@ static struct sock *sctp_clone_sock(struct sock *sk,
 	if (!newsk)
 		return ERR_PTR(err);
 
-	/* sk_clone() sets refcnt to 2 */
+	/* sk_clone() sets refcnt to 2 and increments sockets_allocated */
 	sock_put(newsk);
+	sk_sockets_allocated_dec(newsk);
 
 	newinet = inet_sk(newsk);
 	newsp = sctp_sk(newsk);
-- 
2.47.1

Re: [PATCH net] sctp: fix sockets_allocated imbalance after sk_clone()

[Kuniyuki Iwashima]

On Fri, Apr 17, 2026 at 2:09 PM Xin Long <lucien.xin@gmail.com> wrote:
>
> sk_clone() increments sockets_allocated and sets the socket refcount to 2.
> SCTP performs additional accounting in sctp_clone_sock(), so the clone-time
> increment must be undone to avoid double counting.
>
> Note we cannot simply remove the SCTP-side increment, because the SCTP
> destroy path in sctp_destroy_sock() only decrements sockets_allocated when
> sp->ep is set, which may not be true for all failure paths in
> sctp_clone_sock().
>
> Fixes: 16942cf4d3e3 ("sctp: Use sk_clone() in sctp_accept().")
> Signed-off-by: Xin Long <lucien.xin@gmail.com>

Thanks for the fix.

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

I fixed a similar one in 622e8838a298.  We may want to
perform inc/dec regardless of sp->ep and simplify the code
once net-next opens.

Re: [PATCH net] sctp: fix sockets_allocated imbalance after sk_clone()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 17 Apr 2026 17:09:40 -0400 you wrote:
> sk_clone() increments sockets_allocated and sets the socket refcount to 2.
> SCTP performs additional accounting in sctp_clone_sock(), so the clone-time
> increment must be undone to avoid double counting.
> 
> Note we cannot simply remove the SCTP-side increment, because the SCTP
> destroy path in sctp_destroy_sock() only decrements sockets_allocated when
> sp->ep is set, which may not be true for all failure paths in
> sctp_clone_sock().
> 
> [...]

Here is the summary with links:
  - [net] sctp: fix sockets_allocated imbalance after sk_clone()
    https://git.kernel.org/netdev/net/c/7c9b012d6367

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html