diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 83628c347744..507b2ad5ef7c 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1829,6 +1829,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc, err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); if (err) goto err; + if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) { + err = -EINVAL; + goto err; + } } if (sctp_state(asoc, CLOSED)) {