Re: [PATCH net] sctp: reset stored flag for each association

[Xin Long]

On Sun, Nov 8, 2026 at 11:12 AM Weiming Shi <bestswngs@xxxxxxxxx> wrote:
>
> sctp_send_asconf_del_ip() walks every association on an endpoint. The
> stored flag records that the current association took the single-homed
> deferral path and therefore did not allocate an ASCONF chunk. It is
> currently scoped to the whole function. Once one association sets it,
> later eligible multihomed associations allocate chunks but skip
> sctp_send_asconf(), leaking each chunk and its skb.
>
> Reset stored for every association so only an association taking the
> deferral path skips transmission. In an A/B kmemleak test, the
> vulnerable kernel reported 210 leaked objects from this call path and the
> fixed kernel reported none.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 8a07eb0a50ae ("sctp: Add ASCONF operation on the single-homed host")
> Reported-by: Xiang Mei <xmei5@xxxxxxx>
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
> ---
>  net/sctp/socket.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index c7b9e325ec1c..ed91ceff45a9 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -771,7 +771,6 @@ static int sctp_send_asconf_del_ip(struct sock              *sk,
>         struct sctp_sockaddr_entry *saddr;
>         int                     i;
>         int                     retval = 0;
> -       int                     stored = 0;
>
>         chunk = NULL;
>         sp = sctp_sk(sk);
> @@ -784,6 +783,7 @@ static int sctp_send_asconf_del_ip(struct sock              *sk,
>                  __func__, sk, addrs, addrcnt);
>
>         list_for_each_entry(asoc, &ep->asocs, asocs) {
> +               int stored = 0;
>
>                 if (!asoc->peer.asconf_capable)
>                         continue;
> --
> 2.56.0
>

Acked-by: Xin Long <lucien.xin@xxxxxxxxx>