[PATCH] sctp: avoid requeueing pending control chunks

[Kyle Zeng <kylebot@openai.com>]

The T4 and RE-CONFIG timeout handlers take a reference to their cached
control chunk and submit it through SCTP_CMD_REPLY. A previous transmission
can still be on the control outqueue when output is corked or suppressed,
or when sctp_packet_transmit_chunk() could not append the chunk.

sctp_outq_tail() then adds the same list node a second time. In particular,
re-adding a non-tail entry can corrupt the list without being caught by
the insertion-time list checks. A subsequent flush or association teardown
can walk the corrupted list and access an already freed chunk. The T4 path
is reproducible by an unprivileged SCTP socket owner in a user/network
namespace, with KASAN reporting a use-after-free in __sctp_outq_teardown().

Check sctp_chunk_pending() before adding a control chunk to the outqueue.
If it is already linked, release the extra reference supplied for this
enqueue and leave the existing queue entry in place. Continue to the usual
flush so that the pending transmission can be retried.

This also covers RE-CONFIG retransmission after sctp_assoc_rm_peer() moves
the request to another transport and starts its timer. Keep the existing
timer handling, corking rules and data-chunk path unchanged.

Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
I have a reproducer for this issue and can share via DM

 net/sctp/outqueue.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index e92fb9da4647..a5f9f0fcf5fd 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -304,6 +304,11 @@ void sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk, gfp_t gfp)
 			SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);
 		else
 			SCTP_INC_STATS(net, SCTP_MIB_OUTORDERCHUNKS);
+	} else if (sctp_chunk_pending(chunk)) {
+		/* A retransmitted control chunk may still be queued.
+		 * Drop the extra reference and retry the flush below.
+		 */
+		sctp_chunk_free(chunk);
 	} else {
 		list_add_tail(&chunk->list, &q->control_chunk_list);
 		SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.56.0