In `sctp_getsockopt_pr_streamstatus()`, when the stream output extension
(`streamoute`) has not yet been allocated for `params.sprstat_sid`, the
function zeroes `params.sprstat_abandoned_unsent` and
`params.sprstat_abandoned_sent`, sets `retval = 0`, and jumps directly
to `out:`, skipping both `put_user(len, optlen)` and
`copy_to_user(optval, &params, len)`.

Consequently, `getsockopt(SCTP_PR_STREAM_STATUS)` returns `0` to
userspace without writing the zeroed statistics into the caller's
`optval` buffer.

Remove the premature `goto out` so the zeroed statistics and `optlen`
are copied to userspace.

Fixes: f952be79cebd ("sctp: introduce struct sctp_stream_out_ext")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/sctp/socket.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c7b9e325ec1c..f3e48861e9e6 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7569,11 +7569,7 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
 		/* Not allocated yet, means all stats are 0 */
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
-		retval = 0;
-		goto out;
-	}
-
-	if (policy == SCTP_PR_SCTP_ALL) {
+	} else if (policy == SCTP_PR_SCTP_ALL) {
 		params.sprstat_abandoned_unsent = 0;
 		params.sprstat_abandoned_sent = 0;
 		for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
@@ -7589,6 +7585,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
 			streamoute->abandoned_sent[__SCTP_PR_INDEX(policy)];
 	}
 
+	retval = 0;
+
 	if (put_user(len, optlen) || copy_to_user(optval, &params, len)) {
 		retval = -EFAULT;
 		goto out;
-- 
2.55.0.1082.g2b9226bbc0-goog

On 9/19/26 23:36, Hui Peng wrote:
> @@ -7589,6 +7585,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
>   			streamoute->abandoned_sent[__SCTP_PR_INDEX(policy)];
>   	}
>   
> +	retval = 0;
> +

AFAICS the above is not needed; retval will be zeroed later, if in case of
no errors.

Also this is IMHO net-next material with no fixes tag.

/P

On Thu, Sep 24, 2026 at 6:14 AM Paolo Abeni <pabeni@redhat.com> wrote:
>
> On 9/19/26 23:36, Hui Peng wrote:
> > @@ -7589,6 +7585,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
> >                       streamoute->abandoned_sent[__SCTP_PR_INDEX(policy)];
> >       }
> >
> > +     retval = 0;
> > +
>
> AFAICS the above is not needed; retval will be zeroed later, if in case of
> no errors.
Agree.

>
> Also this is IMHO net-next material with no fixes tag.
>
If users call getsockopt(SCTP_PR_STREAM_STATUS, &param) without zeroing
param, the kernel should still initialize the output fields when the call
succeeds (return 0).

So we may think of it as a Fix.

Thanks.