From 0064d9a1931da7d4f5152fe03706e2d56513990d Mon Sep 17 00:00:00 2001
From: Michael Tuexen <tuexen@FreeBSD.org>
Date: Wed, 25 Feb 2026 13:55:54 +0100
Subject: [PATCH] sctp: fix so_proto when peeling off a socket

Reported by:		glebius
Reviewed by:		rrs
Fixes:			d195b3783fa4 ("sctp: fix socket type created by sctp_peeloff()")
Differential Revision:	https://reviews.freebsd.org/D55454
Event:			Wiesbaden Hackathon 2026

(cherry picked from commit 454212b9718b55b43781f81bef252658e20e0fd3)
---
 sys/kern/uipc_socket.c      | 4 ++--
 sys/netinet/sctp_syscalls.c | 4 +++-
 sys/sys/socketvar.h         | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 6468b3001b3..e61b256aaf2 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -1286,7 +1286,7 @@ solisten_enqueue(struct socket *so, int connstatus)
  * XXXGL: reduce copy-paste with solisten_clone().
  */
 struct socket *
-sopeeloff(struct socket *head)
+sopeeloff(struct socket *head, struct protosw *so_proto)
 {
 	struct socket *so;
 
@@ -1304,7 +1304,7 @@ sopeeloff(struct socket *head)
 	so->so_linger = head->so_linger;
 	so->so_state = (head->so_state & SS_NBIO) | SS_ISCONNECTED;
 	so->so_fibnum = head->so_fibnum;
-	so->so_proto = head->so_proto;
+	so->so_proto = so_proto;
 	so->so_cred = crhold(head->so_cred);
 #ifdef MAC
 	mac_socket_newconn(head, so);
diff --git a/sys/netinet/sctp_syscalls.c b/sys/netinet/sctp_syscalls.c
index 9d85576e259..79c1dfb2149 100644
--- a/sys/netinet/sctp_syscalls.c
+++ b/sys/netinet/sctp_syscalls.c
@@ -76,6 +76,8 @@
 #include <security/mac/mac_framework.h>
 
 #include <netinet/sctp.h>
+#include <netinet/sctp_pcb.h>
+#include <netinet/sctp_var.h>
 #include <netinet/sctp_os_bsd.h>
 #include <netinet/sctp_peeloff.h>
 
@@ -172,7 +174,7 @@ sys_sctp_peeloff(struct thread *td, struct sctp_peeloff_args *uap)
 	td->td_retval[0] = fd;
 
 	CURVNET_SET(head->so_vnet);
-	so = sopeeloff(head);
+	so = sopeeloff(head, &sctp_stream_protosw);
 	if (so == NULL) {
 		error = ENOMEM;
 		goto noconnection;
diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h
index 1efff4a18be..fc884467470 100644
--- a/sys/sys/socketvar.h
+++ b/sys/sys/socketvar.h
@@ -525,7 +525,7 @@ struct socket *
 struct socket *
 	sonewconn(struct socket *head, int connstatus);
 struct socket *
-	sopeeloff(struct socket *);
+	sopeeloff(struct socket *, struct protosw *);
 int	sopoll(struct socket *so, int events, struct ucred *active_cred,
 	    struct thread *td);
 int	sopoll_generic(struct socket *so, int events,