Re: [PATCH] sctp: hold shkey across socket migration

[Xin Long]

On Fri, Jul 31, 2026 at 8:06 AM David Lee <david.lee@xxxxxxxxxxxxxxx> wrote:
>
> sctp_sock_migrate() transfers queued DATA skbs from the old socket to
> the new one. skb_orphan() invokes sctp_wfree() during that transfer and
> drops the skb-owned shared-key reference.
>
> If userspace has removed that key from the association, this can be the
> final reference. The following sctp_set_owner_w() then dereferences the
> freed chunk->shkey while trying to take the new owner reference.
>
> Take a temporary shared-key reference before orphaning the skb and
> release it after the new owner has taken its reference. This preserves
> the selected authentication key throughout the ownership transfer.
>
> Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key")
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
>
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>

The "Fixes: " is not together with others at the end, and the "Signed-off-by:"
for yourself is also missed:

Signed-off-by: David Lee <david.lee@xxxxxxxxxxxxxxx>

Patch looks good to me:

Acked-by: Xin Long <lucien.xin@xxxxxxxxx>

Not sure if you need to repost for fixing the tags, let's see.

Thanks.