Re: [PATCH net-next] net/iucv: fix UAF in afiucv_netdev_event()

[Nagamani PV <nagamani@linux.ibm.com>]

On 04/08/26 11:51 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> 
> New issues:
> - [High] The patch introduces a sleep-in-atomic-context bug by calling a sleepable memory allocation function while holding a spinlock (`read_lock_bh`) that disables bottom halves.
> 

Correct.  Fixed in v2 by a two-pass design: iucv_send_ctrl() is only
called in Pass 2, after read_unlock_bh().  Pass 1 uses GFP_ATOMIC.

> Pre-existing issues:
> - [High] Socket state, shutdown flags, and transmissions are manipulated locklessly, leading to data races, lost state updates, and a potential NULL pointer dereference if the socket is orphaned concurrently.
> 

Correct.  All three sub-findings confirmed with KCSAN on IBM Z.
Fixed in v2: Pass 2 acquires lock_sock() per socket, serialising
sk->sk_state, sk->sk_shutdown, and iucv_send_ctrl() against
iucv_sock_close() and sock_orphan().

Pass 1 reads iucv->hs_dev under read_lock_bh while iucv_sock_close()
writes hs_dev = NULL under lock_sock() — orthogonal locks. READ_ONCE()
/ WRITE_ONCE() document the intentional concurrent access and suppress
KCSAN reports on those accesses.

v2 posted to netdev:
  https://lore.kernel.org/netdev/20260917071706.23831-1-nagamani@linux.ibm.com/

Validated with KASAN + KCSAN TAP on IBM Z.

Thanks,
Nagamani PV