Re: [PATCH net 1/2] net/iucv: clear hs_dev before dropping its reference

[sashiko-bot@kernel.org]

> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> iucv_sock_close() drops the socket's reference on its HiperSockets
> device and only then clears iucv->hs_dev, while afiucv_hs_rcv() compares
> that field against the ingress device for every socket in the list,
> under iucv_sk_list.lock and not the socket lock. Between the two it
> compares a pointer the socket no longer holds; KCSAN reports the plain
> read against the plain write. The order dates from 800c5eb7b5eb, the
> compare from 80230a18c164. Nothing user-visible is known from it: the
> receive path holds the ingress device, so the stale pointer is compared,
> never dereferenced.
> 
> Clear the pointer first, through a local, then drop the reference, and
> mark the lookup's read and the two stores that race with it: the clear
> in close and the listener's child's, which is in iucv_sk_list from
> [ ... ]
> Fixes: 80230a18c164 ("net/iucv: filter frames in afiucv_hs_rcv() by ingress device")
> Reported-by: Hidayath Khan <hidayath@linux.ibm.com>
> Closes: https://lore.kernel.org/netdev/b3fea2ca-25ff-42c0-812c-f8cc6bb6667e@linux.ibm.com/
> Suggested-by: Hidayath Khan <hidayath@linux.ibm.com>
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022-b4-disp-b35a9153-v1-0-d74645876195@proton.me?part=1