[PATCH net] sctp: preserve stream scheduler across outq teardown

[Jun Yang <juny24602@gmail.com>]

From: Jun Yang <junvyyang@tencent.com>

sctp_outq_teardown() reinitializes a live outqueue with sctp_outq_init(),
which clears q->sched before calling sctp_sched_set_sched(). This makes
sctp_sched_set_sched() skip sctp_sched_free_sched(), although the
association's streams still retain their scheduler-private state. If the
socket's default scheduler differs from the installed one, the new
scheduler interprets that stale state through the shared union in
struct sctp_stream_out_ext.

Preserve q->sched across the reset so sctp_sched_set_sched() can free the
old scheduler's per-stream state and clear the union before installing
a different scheduler.

Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Cc: stable@kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Signed-off-by: Jun Yang <junvyyang@tencent.com>
---
A KASAN reproducer for this issue is available if requested.

 net/sctp/outqueue.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index e92fb9da4647..6cb4b4339d8b 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -190,9 +190,13 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
  */
 void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
 {
+	const struct sctp_sched_ops *sched = q->sched;
+
 	memset(q, 0, sizeof(struct sctp_outq));
 
 	q->asoc = asoc;
+	/* Retain the scheduler to allow freeing its per-stream state. */
+	q->sched = sched;
 	INIT_LIST_HEAD(&q->out_chunk_list);
 	INIT_LIST_HEAD(&q->control_chunk_list);
 	INIT_LIST_HEAD(&q->retransmit);
-- 
2.54.0 (Apple Git-157)