Re: [PATCH net-next v2] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

[Simon Horman]

On Wed, Sep 30, 2026 at 04:46:11AM +0000, Hui Peng wrote:
> When an SCTP stream output extension structure (streamoute) has not yet
> been allocated, sctp_getsockopt_pr_streamstatus() sets the local stack
> variables params.sprstat_abandoned_unsent = 0 and
> params.sprstat_abandoned_sent = 0, but then immediately jumps to 'out:',
> bypassing copy_to_user(). As a result, when an uninitialized user buffer
> is passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns
> success (0) without copying the zeroed stats back to user space, leaving
> uninitialized data in the user buffer.
> 
> Refactor the !streamoute check into an if-else chain so that when
> streamoute is NULL, params is zeroed and falls through to copy_to_user(),
> copying the zeroed stats to user space and setting retval = 0 once before
> returning.
> 
> Tested in QEMU against Linux 7.3.0-rc3 using an uninitialized
> sctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a
> freshly created stream: on the unfixed kernel the user struct contains
> uninitialized stack garbage; whereas with this fix applied, getsockopt()
> copies zeroed stats into user space and returns 0.
> 
> Fixes: 28b7eab0f910 ("sctp: add SCTP_PR_STREAM_STATUS getsockopt")

The hash cited above does not seem to exist.
I suggest that the appropriate fixes tag is as you had for v1:

Fixes: 28b7eab0f910 ("sctp: add SCTP_PR_STREAM_STATUS getsockopt")

Also, the patch should probably be targeted at net, again as you had for v1.
I realised that Paolo suggested net-next, without a Fixes tag. But I
believe the premise of that suggestion was that he felt this was not a bug fix.
However, Xin responded stating he thought it was, and I expect that carries,
especially when combined with the updated patch description you have
supplied in v2.

Please treat the above as FYI at this point.
I do not expect a repost is required at this time.

> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Xin Long <lucien.xin@xxxxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---
> Changes in v2:
> - Re-target subject tag to [PATCH net-next v2].
> - Remove redundant retval = 0 assignment in !streamoute block and fall
>   through to copy_to_user() as suggested by Paolo Abeni and Xin Long.

...