Re: [PATCH v3 net] sctp: avoid livelock while updating retransmit path

[Xin Long]

On Tue, Sep 15, 2026 at 5:51 AM Yiqi Sun <sunyiqixm@xxxxxxxxx> wrote:
>
> sctp_assoc_update_retran_path() can loop forever when every remaining
> transport, including retran_path, is SCTP_UNCONFIRMED: the state check
> runs before the wraparound test, so the loop cannot observe that it has
> completed a full pass.
>
> Fix this by considering a transport only when it is not UNCONFIRMED,
> then checking whether the walk has returned to retran_path. This makes
> the full-pass termination independent of the transport state while
> preserving the existing fallback selection semantics.
>
> Also restore the NULL guard around the retran_path assignment. In the
> all-UNCONFIRMED case there is no eligible replacement transport, and
> installing NULL would leave later retransmit-path users and the debug
> print with a NULL path.
>
> Fixes: 4c47af4d5eb2 ("net: sctp: rework multihoming retransmission path selection to rfc4960")
> Signed-off-by: Yiqi Sun <sunyiqixm@xxxxxxxxx>
> ---
> Changes in v3:
> - Post as a new, independent thread.
> - Drop quoted review discussion and the reproducer attachment claim from
>   the commit message.
> - Link to v2: https://lore.kernel.org/r/20260902025206.phbpyxmpf4zrtdpx@sunyiqi-llm-kernel/
> ---
>  net/sctp/associola.c | 15 ++++++++-------
>  1 file changed, 8 insertions(+), 7 deletions(-)
>
> diff --git a/net/sctp/associola.c b/net/sctp/associola.c
> index c0512c827d0f..4521be3bd85a 100644
> --- a/net/sctp/associola.c
> +++ b/net/sctp/associola.c
> @@ -1289,18 +1289,19 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
>                 /* Manually skip the head element. */
>                 if (&trans->transports == &asoc->peer.transport_addr_list)
>                         continue;
> -               if (trans->state == SCTP_UNCONFIRMED)
> -                       continue;
> -               trans_next = sctp_trans_elect_best(trans, trans_next);
> -               /* Active is good enough for immediate return. */
> -               if (trans_next->state == SCTP_ACTIVE)
> -                       break;
> +               if (trans->state != SCTP_UNCONFIRMED) {
> +                       trans_next = sctp_trans_elect_best(trans, trans_next);
> +                       /* Active is good enough for immediate return. */
> +                       if (trans_next->state == SCTP_ACTIVE)
> +                               break;
> +               }
>                 /* We've reached the end, time to update path. */
>                 if (trans == asoc->peer.retran_path)
>                         break;
>         }
>
> -       asoc->peer.retran_path = trans_next;
> +       if (trans_next)
> +               asoc->peer.retran_path = trans_next;
>
>         pr_debug("%s: association:%p updated new path to addr:%pISpc\n",
>                  __func__, asoc, &asoc->peer.retran_path->ipaddr.sa);
> --
> 2.34.1
>
Acked-by: Xin Long <lucien.xin@xxxxxxxxx>