[PATCH net v3] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[PATCH net v3] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[Hui Peng]

When an SCTP stream output extension structure (streamoute) has not yet
been allocated, sctp_getsockopt_pr_streamstatus() sets the local stack
variables params.sprstat_abandoned_unsent = 0 and
params.sprstat_abandoned_sent = 0, but then immediately jumps to 'out:',
bypassing copy_to_user(). As a result, when an uninitialized user buffer
is passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns
success (0) without copying the zeroed stats back to user space, leaving
uninitialized data in the user buffer.

Refactor the !streamoute check into an if-else chain so that when
streamoute is NULL, params is zeroed and falls through to copy_to_user(),
copying the zeroed stats to user space and setting retval = 0 once before
returning.

Tested in QEMU against Linux 7.3.0-rc3 using an uninitialized
sctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a
freshly created stream: on the unfixed kernel the user struct contains
uninitialized stack garbage; whereas with this fix applied, getsockopt()
copies zeroed stats into user space and returns 0.

Fixes: f952be79cebd ("sctp: introduce struct sctp_stream_out_ext")
Cc: stable@vger.kernel.org
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v3:
- Re-target subject tag from [PATCH net-next v2] to [PATCH net v3].
- Fix Fixes: tag SHA to f952be79cebd ("sctp: introduce struct sctp_stream_out_ext")
  as suggested by Simon Horman and Xin Long.

Changes in v2:
- Re-target subject tag to [PATCH net-next v2].
- Remove redundant retval = 0 assignment in !streamoute block and fall
  through to copy_to_user() as suggested by Paolo Abeni and Xin Long.

 net/sctp/socket.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index a2235905d2ee..bc5b78ab589a 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7568,9 +7568,5 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
 	if (!streamoute) {
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
-		retval = 0;
-		goto out;
-	} else if (policy == SCTP_PR_SCTP_ALL) {
+	} else if (policy == SCTP_PR_SCTP_ALL) {
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
-- 
2.47.3

Re: [PATCH net v3] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v3] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[Xin Long]

On Wed, Oct 7, 2026 at 5:51 AM Hui Peng <benquike@gmail.com> wrote:
>
> When an SCTP stream output extension structure (streamoute) has not yet
> been allocated, sctp_getsockopt_pr_streamstatus() sets the local stack
> variables params.sprstat_abandoned_unsent = 0 and
> params.sprstat_abandoned_sent = 0, but then immediately jumps to 'out:',
> bypassing copy_to_user(). As a result, when an uninitialized user buffer
> is passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns
> success (0) without copying the zeroed stats back to user space, leaving
> uninitialized data in the user buffer.
>
> Refactor the !streamoute check into an if-else chain so that when
> streamoute is NULL, params is zeroed and falls through to copy_to_user(),
> copying the zeroed stats to user space and setting retval = 0 once before
> returning.
>
> Tested in QEMU against Linux 7.3.0-rc3 using an uninitialized
> sctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a
> freshly created stream: on the unfixed kernel the user struct contains
> uninitialized stack garbage; whereas with this fix applied, getsockopt()
> copies zeroed stats into user space and returns 0.
>
> Fixes: f952be79cebd ("sctp: introduce struct sctp_stream_out_ext")
> Cc: stable@vger.kernel.org
> Reviewed-by: Xin Long <lucien.xin@gmail.com>
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v3:
> - Re-target subject tag from [PATCH net-next v2] to [PATCH net v3].
> - Fix Fixes: tag SHA to f952be79cebd ("sctp: introduce struct sctp_stream_out_ext")
>   as suggested by Simon Horman and Xin Long.
>
> Changes in v2:
> - Re-target subject tag to [PATCH net-next v2].
> - Remove redundant retval = 0 assignment in !streamoute block and fall
>   through to copy_to_user() as suggested by Paolo Abeni and Xin Long.
>
>  net/sctp/socket.c | 6 +-----
>  1 file changed, 1 insertion(+), 5 deletions(-)
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index a2235905d2ee..bc5b78ab589a 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -7568,9 +7568,5 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
>         if (!streamoute) {
>                 params.sprstat_abandoned_unsent = 0;
>                 params.sprstat_abandoned_sent = 0;
> -               retval = 0;
> -               goto out;
> -       } else if (policy == SCTP_PR_SCTP_ALL) {
> +       } else if (policy == SCTP_PR_SCTP_ALL) {
>                 params.sprstat_abandoned_unsent = 0;
>                 params.sprstat_abandoned_sent = 0;
> --
> 2.47.3
V2 is already applied by netdev maintainer with the Fixes tag fixed.

We can drop this one now.

Thanks.