From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 292BE42FCA9; Mon, 17 Aug 2026 15:12:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786979558; cv=none; b=DdE0CWd1xAInVrKp6doUWL4T1QQtOF25he5vtzhSGRwBmsT0knx3rrYUyO4r4BxKYIV4+O8PSaq1apXnGjeiaZzrgiMBUSm5fF/vqGrFn4LcJx9vow9t4z4wEFfn4mLgx5zp3Zad2+cGp/4BpW2BgiyS4QMs/1e1JLB4q4hHWRg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786979558; c=relaxed/simple; bh=IRPRZWK/OxOS8Wvz5mHoK/Dbb45LmSC2Oc7MRwNzLUM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cgg19LcPJabZcFuXy04iQaKgRhJVxJfY8UypNsxsprPErsffVJFAvrz7e6FzemVjlGoQflSSBtQLh/oT1trbAmam7vZ/qqRPacQE1QK3rykESMmHEZhpC0+1KScJAsP80YCmmS7JiQjXAEPs1eKIjENFCNHC9zX0kMFMvdeYeyA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qix9i4Wb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="qix9i4Wb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58DBC1F000E9; Mon, 17 Aug 2026 15:12:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786979556; bh=zFWRtiN/wNaaWOQ+S+xPxG+VmrzhjuqVlyf1dQmyxGk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qix9i4Wb2ctaJ02LvbzQadfj40gYUSlHVsiMRBN1AOxjwoOwhuumvErf8AZTy/prT K4QR0lUlsqRg/2QiJqV7nvZf3BhYGAQHyFf6wI2VDTYVXag5SXgld4XJclhmlKadtJ 6iOXkNLN5lBspLHdJCjF2yDJTM3OWkMcdbkteeRw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bryam Vargas , Paolo Abeni Subject: [PATCH 6.1 266/609] net/iucv: fix use-after-free of a severed iucv_path Date: Mon, 17 Aug 2026 15:29:22 +0200 Message-ID: <20260817132553.016292269@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132543.039278408@linuxfoundation.org> References: <20260817132543.039278408@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bryam Vargas commit be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a upstream. af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path. Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued. Fixes: f0703c80e515 ("[AF_IUCV]: postpone receival of iucv-packets") Closes: https://sashiko.dev/#/patchset/20260705-b4-disp-fc79c0dc-v1-1-d2cdcb57afa9@proton.me?part=1 Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Link: https://patch.msgid.link/20260707-b4-disp-783fedbb-v1-1-463b9dbda2ea@proton.me Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman --- net/iucv/af_iucv.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -334,6 +334,7 @@ static void iucv_sever_path(struct sock unsigned char user_data[16]; struct iucv_sock *iucv = iucv_sk(sk); struct iucv_path *path = iucv->path; + struct sock_msg_q *p, *n; /* Whoever resets the path pointer, must sever and free it. */ if (xchg(&iucv->path, NULL)) { @@ -345,6 +346,19 @@ static void iucv_sever_path(struct sock } else pr_iucv->path_sever(path, NULL); iucv_path_free(path); + + /* + * Message notifications queued on message_q still reference + * the now freed path; drop them, otherwise a later recvmsg() + * would pass the freed iucv_path to message_receive() via + * iucv_process_message_q(). + */ + spin_lock_bh(&iucv->message_q.lock); + list_for_each_entry_safe(p, n, &iucv->message_q.list, list) { + list_del(&p->list); + kfree(p); + } + spin_unlock_bh(&iucv->message_q.lock); } }