Re: [PATCH net] net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

[Hidayathulla Khan I <hidayath@linux.ibm.com>]

On 10/07/26 3:04 pm, Jagielski, Jedrzej wrote:
> From: Hidayath Khan <hidayath@linux.ibm.com>
> Sent: Thursday, July 9, 2026 9:18 PM
>
>> afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC.
>> If the allocation fails, nsk is NULL.
>>
>> The connection-refused path is entered when the listen state check
>> fails, the accept backlog is full, or nsk is NULL. The code
>> unconditionally calls iucv_sock_kill(nsk) in that path.
>>
>> iucv_sock_kill() does not accept a NULL socket pointer and immediately
>> dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL,
>> calling iucv_sock_kill(nsk) results in a NULL pointer dereference.
>>
>> Only call iucv_sock_kill() when a child socket was successfully
>> allocated.
>>
>> Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport")
>> Cc: stable@vger.kernel.org
>> Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
>> Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
>> ---
>> net/iucv/af_iucv.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
>> index fed240b453bd..f5b1ec44b6ae 100644
>> --- a/net/iucv/af_iucv.c
>> +++ b/net/iucv/af_iucv.c
>> @@ -1872,7 +1872,8 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
>> 		afiucv_swap_src_dest(skb);
>> 		trans_hdr->flags = AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_FIN;
>> 		err = dev_queue_xmit(skb);
>> -		iucv_sock_kill(nsk);
>> +		if (nsk)
> Hi Hidayath
>
> why not to move this check into iucv_sock_kill()?
> would prevent from potential similar issues in the future
Hi Jedrzej,

Every other call to iucv_sock_kill() passes a non-NULL socket by 
construction.

If iucv_sock_kill() silently accepted NULL, a future caller wrongly
passing NULL would go unnoticed instead of being caught.

>
>> +			iucv_sock_kill(nsk);
>> 		bh_unlock_sock(sk);
>> 		goto out;
>> 	}
>>
>> base-commit: 262b2eac463d880a664cf92af1107b4f9d84ad37
>> -- 
>> 2.52.0
>
>