[PATCH net-next v2] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[PATCH net-next v2] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[Hui Peng]

When an SCTP stream output extension structure (streamoute) has not yet
been allocated, sctp_getsockopt_pr_streamstatus() sets the local stack
variables params.sprstat_abandoned_unsent = 0 and
params.sprstat_abandoned_sent = 0, but then immediately jumps to 'out:',
bypassing copy_to_user(). As a result, when an uninitialized user buffer
is passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns
success (0) without copying the zeroed stats back to user space, leaving
uninitialized data in the user buffer.

Refactor the !streamoute check into an if-else chain so that when
streamoute is NULL, params is zeroed and falls through to copy_to_user(),
copying the zeroed stats to user space and setting retval = 0 once before
returning.

Tested in QEMU against Linux 7.3.0-rc3 using an uninitialized
sctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a
freshly created stream: on the unfixed kernel the user struct contains
uninitialized stack garbage; whereas with this fix applied, getsockopt()
copies zeroed stats into user space and returns 0.

Fixes: 28b7eab0f910 ("sctp: add SCTP_PR_STREAM_STATUS getsockopt")
Cc: stable@vger.kernel.org
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Re-target subject tag to [PATCH net-next v2].
- Remove redundant retval = 0 assignment in !streamoute block and fall
  through to copy_to_user() as suggested by Paolo Abeni and Xin Long.

 net/sctp/socket.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c7b9e325ec1c..1aa475d9dfdb 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7569,11 +7569,7 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
 		/* Not allocated yet, means all stats are 0 */
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
-		retval = 0;
-		goto out;
-	}
-
-	if (policy == SCTP_PR_SCTP_ALL) {
+	} else if (policy == SCTP_PR_SCTP_ALL) {
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
 		for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {

Re: [PATCH net-next v2] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[Simon Horman]

On Wed, Sep 30, 2026 at 04:46:11AM +0000, Hui Peng wrote:
> When an SCTP stream output extension structure (streamoute) has not yet
> been allocated, sctp_getsockopt_pr_streamstatus() sets the local stack
> variables params.sprstat_abandoned_unsent = 0 and
> params.sprstat_abandoned_sent = 0, but then immediately jumps to 'out:',
> bypassing copy_to_user(). As a result, when an uninitialized user buffer
> is passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns
> success (0) without copying the zeroed stats back to user space, leaving
> uninitialized data in the user buffer.
> 
> Refactor the !streamoute check into an if-else chain so that when
> streamoute is NULL, params is zeroed and falls through to copy_to_user(),
> copying the zeroed stats to user space and setting retval = 0 once before
> returning.
> 
> Tested in QEMU against Linux 7.3.0-rc3 using an uninitialized
> sctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a
> freshly created stream: on the unfixed kernel the user struct contains
> uninitialized stack garbage; whereas with this fix applied, getsockopt()
> copies zeroed stats into user space and returns 0.
> 
> Fixes: 28b7eab0f910 ("sctp: add SCTP_PR_STREAM_STATUS getsockopt")

The hash cited above does not seem to exist.
I suggest that the appropriate fixes tag is as you had for v1:

Fixes: 28b7eab0f910 ("sctp: add SCTP_PR_STREAM_STATUS getsockopt")

Also, the patch should probably be targeted at net, again as you had for v1.
I realised that Paolo suggested net-next, without a Fixes tag. But I
believe the premise of that suggestion was that he felt this was not a bug fix.
However, Xin responded stating he thought it was, and I expect that carries,
especially when combined with the updated patch description you have
supplied in v2.

Please treat the above as FYI at this point.
I do not expect a repost is required at this time.

> Cc: stable@vger.kernel.org
> Reviewed-by: Xin Long <lucien.xin@gmail.com>
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Re-target subject tag to [PATCH net-next v2].
> - Remove redundant retval = 0 assignment in !streamoute block and fall
>   through to copy_to_user() as suggested by Paolo Abeni and Xin Long.

...

Re: [PATCH net-next v2] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[Xin Long]

On Mon, Oct 5, 2026 at 1:06 PM Simon Horman <horms@kernel.org> wrote:
>
> On Wed, Sep 30, 2026 at 04:46:11AM +0000, Hui Peng wrote:
> > When an SCTP stream output extension structure (streamoute) has not yet
> > been allocated, sctp_getsockopt_pr_streamstatus() sets the local stack
> > variables params.sprstat_abandoned_unsent = 0 and
> > params.sprstat_abandoned_sent = 0, but then immediately jumps to 'out:',
> > bypassing copy_to_user(). As a result, when an uninitialized user buffer
> > is passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns
> > success (0) without copying the zeroed stats back to user space, leaving
> > uninitialized data in the user buffer.
> >
> > Refactor the !streamoute check into an if-else chain so that when
> > streamoute is NULL, params is zeroed and falls through to copy_to_user(),
> > copying the zeroed stats to user space and setting retval = 0 once before
> > returning.
> >
> > Tested in QEMU against Linux 7.3.0-rc3 using an uninitialized
> > sctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a
> > freshly created stream: on the unfixed kernel the user struct contains
> > uninitialized stack garbage; whereas with this fix applied, getsockopt()
> > copies zeroed stats into user space and returns 0.
> >
> > Fixes: 28b7eab0f910 ("sctp: add SCTP_PR_STREAM_STATUS getsockopt")
>
> The hash cited above does not seem to exist.
> I suggest that the appropriate fixes tag is as you had for v1:
>
> Fixes: 28b7eab0f910 ("sctp: add SCTP_PR_STREAM_STATUS getsockopt")
>
> Also, the patch should probably be targeted at net, again as you had for v1.
> I realised that Paolo suggested net-next, without a Fixes tag. But I
> believe the premise of that suggestion was that he felt this was not a bug fix.
> However, Xin responded stating he thought it was, and I expect that carries,
> especially when combined with the updated patch description you have
> supplied in v2.
>
> Please treat the above as FYI at this point.
> I do not expect a repost is required at this time.
>
Thanks Simon,

Yes, the fixes tag should be the one in v1:

Fixes: f952be79cebd ("sctp: introduce struct sctp_stream_out_ext")

> > Cc: stable@vger.kernel.org
> > Reviewed-by: Xin Long <lucien.xin@gmail.com>
> > Assisted-by: LLM
> > Signed-off-by: Hui Peng <benquike@gmail.com>
> > ---
> > Changes in v2:
> > - Re-target subject tag to [PATCH net-next v2].
> > - Remove redundant retval = 0 assignment in !streamoute block and fall
> >   through to copy_to_user() as suggested by Paolo Abeni and Xin Long.
>
> ...