From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD00F46AA92 for ; Tue, 21 Jul 2026 16:02:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784649760; cv=none; b=jmH0nA4ExRa35FG7aNq5QkpHmqN/huDWbrWOuWaElSTEO1xzgKufHDx2mH7EQC7N/I5X57GpZvC0w+R59a/GZU9eoR4FFJEMO2nboM52Nj/42krcP2Ww4h5WI4mN3rfzZB3PfdA8j7tPNWIdcH8nSlt39dn1TpfQHeKaXMTYrRY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784649760; c=relaxed/simple; bh=QbecFF3Bj+oUuUqMeYFOnB+fOLZZQA5qxTNfzeNSYs0=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Jb8sjxzKSYTjMibZCcNa7ut/P496fgmJGU4MDaUnu1/sPzkJUF/xxOxFBemRHA2iTkKn7Mcli/JIfJ5u2thWfk/AkAf/Gr3h2oQYIAuCXXL4Z99FkWYFzLkeHG8IEynhAefHEVk/yD54NciUhKgcS6Mst2cjxPG6S0o0mokAeN8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=iSeWxLNh; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=QVVx6lJd; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="iSeWxLNh"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="QVVx6lJd" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784649757; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/6x6QNzb/HvmxRGGOWk16eMCJgHy8fOxO3QEXxqvBLQ=; b=iSeWxLNhectrToWd4lKm5S69c99eJLtpPXk6ynYwkYzSQYyMS23EA/F5Be9iUxoB5XkckW /56rn85eC9sef6pBZkBIN7hXt48IYuHPa7aO6Ii4hCPHaXFDFPD1GjQ2eY71Tayguob5hL lwy4dJmDkaHZyLWawPfrvMZvUefmEjA= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-630-5-vleMTCMEep4GHeRa9jgg-1; Tue, 21 Jul 2026 12:02:36 -0400 X-MC-Unique: 5-vleMTCMEep4GHeRa9jgg-1 X-Mimecast-MFC-AGG-ID: 5-vleMTCMEep4GHeRa9jgg_1784649755 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-475e540a0ffso6626774f8f.3 for ; Tue, 21 Jul 2026 09:02:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1784649755; x=1785254555; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=/6x6QNzb/HvmxRGGOWk16eMCJgHy8fOxO3QEXxqvBLQ=; b=QVVx6lJdH8tJyXdEWIse8Lol2ivbUulabJWzmHZCqtbzhCnpSUrHK0N92efqGyZ88E Ksj76C4q9z39fEui0zWbPsaBLwHLRGs7VRTEUuYTDamCFWJ/2g3bTA+9IMwuQe8wQJxA YZyE4nRBK9fnNVRTzxOzoAHmhjFoSSO5Hq511pPhwrG2A+0YQG2LyyhKwN/Kj/YvjmSt 4WGGhqPIw/2ob/E6F4hrXd7xVFqokjW/NaU+3mu06/qU9bILxNrT5v1U0xY7K37cAhxv 1zdLBV5O36sqt0JLGt4yh/aeovWq8bAYMwkY7Vkx5MsHTATvg4DErRm4vDLLtoTtrvgJ Yl9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784649755; x=1785254555; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/6x6QNzb/HvmxRGGOWk16eMCJgHy8fOxO3QEXxqvBLQ=; b=tUXgWdaqXtcROS11LJSQYl85q/ovlzFB0FBob3q03V8ZSQ935s1FH3osPBr7BpwfO6 8aZbCLu2QS3fowCkyXDvrzBXxfPMMUbx7jrbH0Ya6LrNziiCu8iHdx7g3EEjt9xRi/qI oWX7a3+O4eX699TbMFlQVkypgvjrorjBb5MtH/qwMRTXSgM3IKWrZ97XSoaiofENmmcJ KtMXQF1EWj/iVWjYqmHR1M2oMAoM1rjcZLVhkGonW8iq46ipyEg4YJA0y6g+RCvp0GpE NAzvpFEVvWBQr4XldQzeP5XnHV9jPdiyF3KPRaw60eb534D9O9366pfWmiiwvKp4f4Rg Au5g== X-Forwarded-Encrypted: i=1; AHgh+Roob0HVHmDvhrr3jtcJ/fpvo/fQSondxOzIvLpdkRrL2nKat6gaNPex/Ubg4epmRYnlDAE/KiVRzFqsYt4=@vger.kernel.org X-Gm-Message-State: AOJu0YyE2dTunfoTBqVlaKeNMcGFawoidFQXA5+Rp/nDmOWgWeBh+BEq daxn5XeehK3dtU99udc11TEoHnf8SJTi50ZtnP3XayDmO3UwctNOB5TaoTomVlTMZF4xH5IT46a tNW7LgpSmnzsmWOze3AWEo9ef0poTgwZqjK9GB1keAgw5T0y5VaCh/TucmBodRuMftQ== X-Gm-Gg: AfdE7cmg/8So9DVhjMUT8/0MvQX/1GsvqldG8r6U4RJ9WqTPBarrTWy91OMf5WXoPbC hxpIi3Qnw7S7BqXnpNNogCNzcVuNscop+qF0yDNFtg4b0l4/zmNKFWuPBx/+oWjpoxrMUp5ywfY Rm2hjIjVIT8bpXu7rbc3MkAhJaWRWl8nUUOiMoKh3g0PJVQugidR3Sxii8P540FNuhuSIIF2ROu uHCFpwyHvp6FZ83KVIiw3Mf43jqJQAocBezbPUes8U5TS/gXhtNuj2WXfHp8q+rMD/qJMwzcrmC aJwOAO8brEY4qzAxi83JIVHbDzcE1jSvbSf7Rui6eDpPLIjRSDnAfcmiJSjOMM9rshgMVRzV0gN NHe0bzR4kiVDAHSOL9voQYs3aNtF8py717ER9ZVQo6Kmb7zPL8kk5hjz+0edrG3WCXOG+kZqMQL iCrw== X-Received: by 2002:a05:600c:1549:b0:493:c601:3e23 with SMTP id 5b1f17b1804b1-4954a3d08c0mr211720305e9.5.1784649754873; Tue, 21 Jul 2026 09:02:34 -0700 (PDT) X-Received: by 2002:a05:600c:1549:b0:493:c601:3e23 with SMTP id 5b1f17b1804b1-4954a3d08c0mr211719605e9.5.1784649754333; Tue, 21 Jul 2026 09:02:34 -0700 (PDT) Received: from ?IPV6:2a0d:3344:5521:6b10:58fd:68f:7756:389d? ([2a0d:3344:5521:6b10:58fd:68f:7756:389d]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-495653bfed7sm87017835e9.11.2026.07.21.09.02.25 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 21 Jul 2026 09:02:26 -0700 (PDT) Message-ID: <593ad84c-279d-4d3e-8137-f48188c45c8e@redhat.com> Date: Tue, 21 Jul 2026 18:02:24 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net] net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() To: Alexandra Winter , Hidayath Khan , davem@davemloft.net, edumazet@google.com, kuba@kernel.org Cc: horms@kernel.org, linux-s390@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, twinkler@linux.ibm.com, heiko.carstens@de.ibm.com, gor@linux.ibm.com, agordeev@linux.ibm.com, borntraeger@linux.ibm.com, svens@linux.ibm.com References: <20260709191732.124092-1-hidayath@linux.ibm.com> From: Paolo Abeni Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 7/21/26 3:54 PM, Alexandra Winter wrote: > On 09.07.26 21:17, Hidayath Khan wrote: >> afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. >> If the allocation fails, nsk is NULL. >> >> The connection-refused path is entered when the listen state check >> fails, the accept backlog is full, or nsk is NULL. The code >> unconditionally calls iucv_sock_kill(nsk) in that path. >> >> iucv_sock_kill() does not accept a NULL socket pointer and immediately >> dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, >> calling iucv_sock_kill(nsk) results in a NULL pointer dereference. >> >> Only call iucv_sock_kill() when a child socket was successfully >> allocated. >> >> Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport") >> Cc: stable@vger.kernel.org >> Reviewed-by: Alexandra Winter >> Signed-off-by: Hidayath Khan >> --- >> net/iucv/af_iucv.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c >> index fed240b453bd..f5b1ec44b6ae 100644 >> --- a/net/iucv/af_iucv.c >> +++ b/net/iucv/af_iucv.c >> @@ -1872,7 +1872,8 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb) >> afiucv_swap_src_dest(skb); >> trans_hdr->flags = AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_FIN; >> err = dev_queue_xmit(skb); >> - iucv_sock_kill(nsk); >> + if (nsk) >> + iucv_sock_kill(nsk); >> bh_unlock_sock(sk); >> goto out; >> } >> >> base-commit: 262b2eac463d880a664cf92af1107b4f9d84ad37 > > > Gentle ping to netdev maintainers: > Did this one get lost in the overflow? > It is all green in patchwork. Is there something you need us to do? > Should we re-send it? > I don't see this as urgent or especially dangerous. It's still alive in PW. Our backlog is unusually huge due to an unfortunate sequence of season holidays and conferences, but hopefully it should get back to normality someday in the future :) /P