diff --git a/net/sctp/socket.c b/net/sctp/socket.c index c76b40322ac7..36db659a0f7f 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1850,6 +1850,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc, err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); if (err) goto err; + if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) { + err = -EINVAL; + goto err; + } } if (sctp_state(asoc, CLOSED)) {