Re: [PATCH RFC net v3 5/7] net/iucv: serialize HiperSockets receive with the socket lock

[sashiko-bot@kernel.org]

> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> The HiperSockets receive callbacks change sk_state under bh_lock_sock()
> without testing sock_owned_by_user(). A SYN|ACK, SYN|FIN or FIN that
> arrives during a system call on the socket is applied under the task
> that holds lock_sock(), which goes on with the state it read. A SYN is
> answered for a listener that close() is emptying: the child is left on
> the accept queue of a socket that is then freed, and nothing can close
> it. It keeps the listener's name, so bind() to that name fails with
> -EADDRINUSE from then on, and it keeps its reference on the net device.
> 
> Either needs only a frame from the peer at the wrong moment. No
> memory-safety report is known.
> 
> Take bh_lock_sock() once in afiucv_hs_rcv(), for every frame that finds
> [ ... ]
> Suggested-by: Alexandra Winter <wintera@linux.ibm.com>
> Link: https://lore.kernel.org/all/20260724222917.134769-1-hexlabsecurity@proton.me/
> Cc: stable@vger.kernel.org # 6.18.x: f38bce9af9e2: net/iucv: take a private, writable frame before rewriting it in place
> Cc: stable@vger.kernel.org # 6.18.x
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110-b4-disp-2a6b4364-v3-0-35677b68e697@proton.me?part=5