On Fri, Oct 24, 2025 at 4:51 AM Stefan Wiehler [off-list ref] wrote:

quoted

Or if lock_sock() is enough, we should use the plain
list_for_each_entry(), or list_for_each_entry_rcu() with
lockdep_sock_is_held() as the 4th arg.

Right, I've already hinted in the commit comment that lock_sock() might be
enough, but I'm not sure about it...

@Xin Long, as you're the author and have already acked, I suppose we actually
need to hold the RCU read lock?

Yes, there's a path not holding sock lock:

  sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

Kuniyuki is right about the TOCTOU issue, we do need a check there:

                if (!--addrcnt)
                        break;

BTW, there is another addrcnt thing in inet_assoc_attr_size(), I think you
can fix it in another patch, like moving nlmsg_new(inet_assoc_attr_size(assoc))
under the lock_sock() in sctp_sock_dump_one() and delete _rcu?

Thanks.