Re: [PATCH net-next] net/iucv: serialize HiperSockets receive with the socket lock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net/iucv: NULL pointer dereference in iucv_send_ctrl() due to race with close()
--

commit 5321e38163a4ca2968c5ea02ef28664bf3a65a46
Author: Bryam Vargas <hexlabsecurity@proton.me>

net/iucv: serialize HiperSockets receive with the socket lock

This commit serializes the HiperSockets receive path and recvmsg() using the
socket lock. It introduces a per-socket backlog to defer frames while the
socket is owned by a user.

Link: https://lore.kernel.org/all/20260724222917.134769-1-hexlabsecurity@proton.me/

> diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
> index 5ba875798aa41..1fcb47a087551 100644
> --- a/net/iucv/af_iucv.c
> +++ b/net/iucv/af_iucv.c

[ ... ]

> @@ -374,26 +377,28 @@ static void iucv_sever_path(struct sock *sk, int with_user_data)
>  static int iucv_send_ctrl(struct sock *sk, u8 flags)
>  {
>  	struct iucv_sock *iucv = iucv_sk(sk);
> -	int err = 0;
>  	int blen;
>  	struct sk_buff *skb;
> -	u8 shutdown = 0;
> +	bool force;
>  
>  	blen = sizeof(struct af_iucv_trans_hdr) +
>  	       LL_RESERVED_SPACE(iucv->hs_dev);

[Severity: High]
Can this code cause a regression by dereferencing a NULL iucv->hs_dev during a
concurrent close()?

If another thread concurrently calls close() on the socket,
__iucv_sock_close() runs under the socket lock and sets iucv->hs_dev to NULL:

net/iucv/af_iucv.c:__iucv_sock_close() {
    ...
	if (iucv->hs_dev) {
		dev_put(iucv->hs_dev);
		iucv->hs_dev = NULL;
    ...
}

Meanwhile, afiucv_netdev_event() can asynchronously execute during netdev state
changes (such as NETDEV_GOING_DOWN) and call iucv_send_ctrl() without holding
lock_sock(sk):

net/iucv/af_iucv.c:afiucv_netdev_event() {
    ...
				if (event == NETDEV_GOING_DOWN)
					iucv_send_ctrl(sk, AF_IUCV_FLAG_FIN);
    ...
}

If this happens concurrently, evaluating LL_RESERVED_SPACE(iucv->hs_dev)
could dereference a NULL device pointer and cause a panic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261011-b4-disp-410518f4-v1-1-753bf3258292@proton.me?part=1