In `sctp_getsockopt_pr_streamstatus()`, when the stream output extension (`streamoute`) has not yet been allocated for `params.sprstat_sid`, the function zeroes `params.sprstat_abandoned_unsent` and `params.sprstat_abandoned_sent`, sets `retval = 0`, and jumps directly to `out:`, skipping both `put_user(len, optlen)` and `copy_to_user(optval, ¶ms, len)`. Consequently, `getsockopt(SCTP_PR_STREAM_STATUS)` returns `0` to userspace without writing the zeroed statistics into the caller's `optval` buffer. Remove the premature `goto out` so the zeroed statistics and `optlen` are copied to userspace. Fixes: f952be79cebd ("sctp: introduce struct sctp_stream_out_ext") Assisted-by: LLM Signed-off-by: Hui Peng --- net/sctp/socket.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index c7b9e325ec1c..f3e48861e9e6 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -7569,11 +7569,7 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len, /* Not allocated yet, means all stats are 0 */ params.sprstat_abandoned_unsent = 0; params.sprstat_abandoned_sent = 0; - retval = 0; - goto out; - } - - if (policy == SCTP_PR_SCTP_ALL) { + } else if (policy == SCTP_PR_SCTP_ALL) { params.sprstat_abandoned_unsent = 0; params.sprstat_abandoned_sent = 0; for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) { @@ -7589,6 +7585,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len, streamoute->abandoned_sent[__SCTP_PR_INDEX(policy)]; } + retval = 0; + if (put_user(len, optlen) || copy_to_user(optval, ¶ms, len)) { retval = -EFAULT; goto out; -- 2.55.0.1082.g2b9226bbc0-goog