From: luoqing When sctp_skb_recv_datagram() detects sk->sk_shutdown & RCV_SHUTDOWN, it breaks out of the loop and returns NULL without setting *err. This leaves the error pointer uninitialized or with a stale value, which can confuse callers expecting a clean shutdown indication. Compare with the generic __skb_wait_for_more_packets() in net/core/datagram.c which properly handles shutdown by setting *err = 0. Fix this by setting *err = 0 before breaking when the socket is shut down, indicating an orderly shutdown rather than an error condition. Signed-off-by: luoqing --- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index c7b9e325ec1c..ea7050b27715 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -9117,8 +9117,10 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags, int *err) if (error) goto no_packet; - if (sk->sk_shutdown & RCV_SHUTDOWN) + if (sk->sk_shutdown & RCV_SHUTDOWN) { + *err = 0; break; + } /* User doesn't want to wait. */ -- 2.25.1 From: luoqing When processing AUTH + COOKIE-ECHO packets, if skb_clone fails due to memory pressure, chunk->auth_chunk is set to NULL but chunk->auth is still set to 1. This causes sctp_auth_chunk_verify to skip the AUTH validation (since auth_chunk is NULL), allowing unauthenticated COOKIE-ECHO packets to be accepted. Fix this by only setting chunk->auth = 1 when skb_clone succeeds. Signed-off-by: luoqing --- net/sctp/associola.c | 3 ++- net/sctp/endpointola.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sctp/associola.c b/net/sctp/associola.c index 62d3cc155809..e54068305396 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -999,7 +999,8 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { chunk->auth_chunk = skb_clone(chunk->skb, GFP_ATOMIC); - chunk->auth = 1; + if (chunk->auth_chunk) + chunk->auth = 1; continue; } } diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c index dfb1719275db..3419748c66bc 100644 --- a/net/sctp/endpointola.c +++ b/net/sctp/endpointola.c @@ -368,7 +368,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work) if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { chunk->auth_chunk = skb_clone(chunk->skb, GFP_ATOMIC); - chunk->auth = 1; + if (chunk->auth_chunk) + chunk->auth = 1; continue; } } -- 2.25.1