[PATCH] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[PATCH] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[Hui Peng]

In `sctp_getsockopt_pr_streamstatus()`, when the stream output extension
(`streamoute`) has not yet been allocated for `params.sprstat_sid`, the
function zeroes `params.sprstat_abandoned_unsent` and
`params.sprstat_abandoned_sent`, sets `retval = 0`, and jumps directly
to `out:`, skipping both `put_user(len, optlen)` and
`copy_to_user(optval, &params, len)`.

Consequently, `getsockopt(SCTP_PR_STREAM_STATUS)` returns `0` to
userspace without writing the zeroed statistics into the caller's
`optval` buffer.

Remove the premature `goto out` so the zeroed statistics and `optlen`
are copied to userspace.

Fixes: f952be79cebd ("sctp: introduce struct sctp_stream_out_ext")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/sctp/socket.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c7b9e325ec1c..f3e48861e9e6 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7569,11 +7569,7 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
 		/* Not allocated yet, means all stats are 0 */
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
-		retval = 0;
-		goto out;
-	}
-
-	if (policy == SCTP_PR_SCTP_ALL) {
+	} else if (policy == SCTP_PR_SCTP_ALL) {
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
 		for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
@@ -7589,6 +7585,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
 			streamoute->abandoned_sent[__SCTP_PR_INDEX(policy)];
 	}
 
+	retval = 0;
+
 	if (put_user(len, optlen) || copy_to_user(optval, &params, len)) {
 		retval = -EFAULT;
 		goto out;
-- 
2.55.0.1082.g2b9226bbc0-goog