Re: [PATCH net v2] sctp: revalidate association sockets after locking

[Jakub Kicinski <kuba@kernel.org>]

On Fri, 13 Nov 2026 11:28:02 +0800 Yong Liu wrote:
> Subject: [PATCH net v2] sctp: revalidate association sockets after locking

1. please use the problem you're solving for the subject, don't
describe the code change, so that the subject doesn't change between
revisions
2. please don't send new versions in reply to old ones

> SCTP timer callbacks and ICMP error lookup cache asoc->base.sk before
> acquiring its BH lock. An accept or peeloff can move the association to
> a new socket in between. Processing under the old socket lock can then
> race with an abort on the new socket that tears down the association's
> queues. Transport and association references do not keep those queues
> alive. With mdelay() instrumentation widening the race, KASAN reported a
> slab-use-after-free in sctp_chunk_abandoned() from the T3 retransmit path.
> 
> The ICMP error handlers also reread asoc->base.sk after lookup, so they
> can use the new socket without holding its BH lock. In particular, the
> PMTU handler can reach the same retransmit path, while protocol-unreachable
> handling can run the state machine directly.
> 
> Recheck the association's socket after locking it in the timer callbacks.
> Treat a mismatch like a busy socket and use the existing reference-counted
> retry path. Pass the socket locked by sctp_err_lookup() to both IPv4 and
> IPv6 error handlers, including their UDP encapsulation callers. Defer PMTU
> and protocol-unreachable processing and ignore redirects when that socket
> no longer matches the association. Require a matching socket for immediate
> error reports as well.
> 
> Use READ_ONCE() for the socket pointer reads in the timer, ICMP, receive
> and backlog paths, paired with WRITE_ONCE() in sctp_assoc_migrate(). Take
> the new socket reference before publishing its pointer. The cached socket
> is protected by BH context and the endpoint's RCU-deferred sock_put().
> 
> The issue was discovered and fixed by Qihoo 360's Tulongfeng multi-agent
> system.

3. please remove this, there's no place in commit message for
advertising
-- 
pw-bot: cr