Re: [PATCH net] sctp: Hold RCU read lock while iterating over address list

[Xin Long]

On Fri, Oct 24, 2025 at 4:51 AM Stefan Wiehler <stefan.wiehler@xxxxxxxxx> wrote:
>
> > Or if lock_sock() is enough, we should use the plain
> > list_for_each_entry(), or list_for_each_entry_rcu() with
> > lockdep_sock_is_held() as the 4th arg.
>
> Right, I've already hinted in the commit comment that lock_sock() might be
> enough, but I'm not sure about it...
>
> @Xin Long, as you're the author and have already acked, I suppose we actually
> need to hold the RCU read lock?
Yes, there's a path not holding sock lock:

  sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

Kuniyuki is right about the TOCTOU issue, we do need a check there:

                if (!--addrcnt)
                        break;

BTW, there is another addrcnt thing in inet_assoc_attr_size(), I think you
can fix it in another patch, like moving nlmsg_new(inet_assoc_attr_size(assoc))
under the lock_sock() in sctp_sock_dump_one() and delete _rcu?

Thanks.