[PATCH net] sctp: fix addip_serial increment on ASCONF_ACK allocation failure

[PATCH net] sctp: fix addip_serial increment on ASCONF_ACK allocation failure

[luoqing]

From: Qing Luo <luoqing@kylinos.cn>

In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate
the ASCONF_ACK chunk due to memory pressure, the code jumps to the
done label where asoc->peer.addip_serial is unconditionally incremented.

This leaves the peer's ASCONF (serial N) unacknowledged while the local
endpoint now expects serial N+1. When the peer retransmits serial N, it
falls into the serial < addip_serial + 1 branch ,
which attempts to look up a cached ACK for serial N. No cached ACK
exists since the allocation failed, so the retransmission is silently
discarded. The peer eventually times out and ABORTs the association.

Move the addip_serial increment inside the if (asconf_ack) block so that
the serial number is only advanced when the ASCONF_ACK is successfully
created and cached. This way, on allocation failure, the serial number
is unchanged and the peer's retransmitted ASCONF will be correctly
re-processed.

Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2)
Signed-off-by: Qing Luo <luoqing@kylinos.cn>
---
 net/sctp/sm_make_chunk.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 8adac9e0cd66..87b5d320977b 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3321,12 +3321,11 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
 			goto done;
 	}
 done:
-	asoc->peer.addip_serial++;
-
 	/* If we are sending a new ASCONF_ACK hold a reference to it in assoc
 	 * after freeing the reference to old asconf ack if any.
 	 */
 	if (asconf_ack) {
+		asoc->peer.addip_serial++;
 		sctp_chunk_hold(asconf_ack);
 		list_add_tail(&asconf_ack->transmitted_list,
 			      &asoc->asconf_ack_list);
-- 
2.25.1

Re: [PATCH net] sctp: fix addip_serial increment on ASCONF_ACK allocation failure

[Jakub Kicinski]

On Thu, 23 Jul 2026 15:18:18 +0800 luoqing wrote:
> From: Qing Luo <luoqing@kylinos.cn>
> 
> In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate
> the ASCONF_ACK chunk due to memory pressure, the code jumps to the
> done label where asoc->peer.addip_serial is unconditionally incremented.
> 
> This leaves the peer's ASCONF (serial N) unacknowledged while the local
> endpoint now expects serial N+1. When the peer retransmits serial N, it
> falls into the serial < addip_serial + 1 branch ,
> which attempts to look up a cached ACK for serial N. No cached ACK
> exists since the allocation failed, so the retransmission is silently
> discarded. The peer eventually times out and ABORTs the association.
> 
> Move the addip_serial increment inside the if (asconf_ack) block so that
> the serial number is only advanced when the ASCONF_ACK is successfully
> created and cached. This way, on allocation failure, the serial number
> is unchanged and the peer's retransmitted ASCONF will be correctly
> re-processed.
> 
> Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2)

nit: missing quotation marks around the subject
-- 
pw-bot: cr

Re: [PATCH net] sctp: fix addip_serial increment on ASCONF_ACK allocation failure

[Xin Long]

On Tue, Jul 28, 2026 at 9:24 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Thu, 23 Jul 2026 15:18:18 +0800 luoqing wrote:
> > From: Qing Luo <luoqing@kylinos.cn>
> >
> > In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate
> > the ASCONF_ACK chunk due to memory pressure, the code jumps to the
> > done label where asoc->peer.addip_serial is unconditionally incremented.
> >
> > This leaves the peer's ASCONF (serial N) unacknowledged while the local
> > endpoint now expects serial N+1. When the peer retransmits serial N, it
> > falls into the serial < addip_serial + 1 branch ,
> > which attempts to look up a cached ACK for serial N. No cached ACK
> > exists since the allocation failed, so the retransmission is silently
> > discarded. The peer eventually times out and ABORTs the association.
> >
> > Move the addip_serial increment inside the if (asconf_ack) block so that
> > the serial number is only advanced when the ASCONF_ACK is successfully
> > created and cached. This way, on allocation failure, the serial number
> > is unchanged and the peer's retransmitted ASCONF will be correctly
> > re-processed.
> >
> > Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2)
>
> nit: missing quotation marks around the subject
> --
> pw-bot: cr

Somehow I missed this patch.

LGTM, except the nit Jakub pointed out.

Thanks.

[PATCH net v2] sctp: fix addip_serial increment on ASCONF_ACK allocation failure

[luoqing]

From: Qing Luo <luoqing@kylinos.cn>

In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate
the ASCONF_ACK chunk due to memory pressure, the code jumps to the
done label where asoc->peer.addip_serial is unconditionally incremented.

This leaves the peer's ASCONF (serial N) unacknowledged while the local
endpoint now expects serial N+1. When the peer retransmits serial N, it
falls into the serial < addip_serial + 1 branch ,
which attempts to look up a cached ACK for serial N. No cached ACK
exists since the allocation failed, so the retransmission is silently
discarded. The peer eventually times out and ABORTs the association.

Move the addip_serial increment inside the if (asconf_ack) block so that
the serial number is only advanced when the ASCONF_ACK is successfully
created and cached. This way, on allocation failure, the serial number
is unchanged and the peer's retransmitted ASCONF will be correctly
re-processed.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Qing Luo <luoqing@kylinos.cn>
---
 net/sctp/sm_make_chunk.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index c02809264075..30c0da27430e 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3327,12 +3327,11 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
 			goto done;
 	}
 done:
-	asoc->peer.addip_serial++;
-
 	/* If we are sending a new ASCONF_ACK hold a reference to it in assoc
 	 * after freeing the reference to old asconf ack if any.
 	 */
 	if (asconf_ack) {
+		asoc->peer.addip_serial++;
 		sctp_chunk_hold(asconf_ack);
 		list_add_tail(&asconf_ack->transmitted_list,
 			      &asoc->asconf_ack_list);
-- 
2.25.1
> nit: missing quotation marks around the subject
> LGTM, except the nit Jakub pointed out.
Correct the code formatting

Re: [PATCH net v2] sctp: fix addip_serial increment on ASCONF_ACK allocation failure

[Xin Long]

On Mon, Aug 3, 2026 at 10:56 PM luoqing <l1138897701@163.com> wrote:
>
> From: Qing Luo <luoqing@kylinos.cn>
>
> In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate
> the ASCONF_ACK chunk due to memory pressure, the code jumps to the
> done label where asoc->peer.addip_serial is unconditionally incremented.
>
> This leaves the peer's ASCONF (serial N) unacknowledged while the local
> endpoint now expects serial N+1. When the peer retransmits serial N, it
> falls into the serial < addip_serial + 1 branch ,
> which attempts to look up a cached ACK for serial N. No cached ACK
> exists since the allocation failed, so the retransmission is silently
> discarded. The peer eventually times out and ABORTs the association.
>
> Move the addip_serial increment inside the if (asconf_ack) block so that
> the serial number is only advanced when the ASCONF_ACK is successfully
> created and cached. This way, on allocation failure, the serial number
> is unchanged and the peer's retransmitted ASCONF will be correctly
> re-processed.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Qing Luo <luoqing@kylinos.cn>

Acked-by: Xin Long <lucien.xin@gmail.com>

Re: [PATCH net v2] sctp: fix addip_serial increment on ASCONF_ACK allocation failure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue,  4 Aug 2026 10:55:14 +0800 you wrote:
> From: Qing Luo <luoqing@kylinos.cn>
> 
> In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate
> the ASCONF_ACK chunk due to memory pressure, the code jumps to the
> done label where asoc->peer.addip_serial is unconditionally incremented.
> 
> This leaves the peer's ASCONF (serial N) unacknowledged while the local
> endpoint now expects serial N+1. When the peer retransmits serial N, it
> falls into the serial < addip_serial + 1 branch ,
> which attempts to look up a cached ACK for serial N. No cached ACK
> exists since the allocation failed, so the retransmission is silently
> discarded. The peer eventually times out and ABORTs the association.
> 
> [...]

Here is the summary with links:
  - [net,v2] sctp: fix addip_serial increment on ASCONF_ACK allocation failure
    https://git.kernel.org/netdev/net/c/aa2e13ae8d3c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html